Microsoft just shipped its largest Patch Tuesday release ever, and your patching pipeline is about to feel it. On September 9, 2026, the company addressed 974 vulnerabilities across its software portfolio, including two actively exploited zero-days in Windows. The scale is unprecedented: 113 of those flaws carry Microsoft's critical severity rating, meaning an attacker could seize control of a vulnerable machine with little or no help from the user. This is a deployment crisis for anyone running Windows at scale.
What exactly did Microsoft ship in September 2026?
The September 2026 release shattered previous records. The 974 CVEs span Windows, Office, SQL Server, Developer Tools, SharePoint Server, Azure, Skype for Business, and Exchange Server. Microsoft also patched 25 non-Microsoft CVEs, bringing the grand total to 999 resolved vulnerabilities in a single day.
Here is the breakdown by product family:
Windows dominates the list with 723 flaws. Office and Office 2016 account for 111. SQL Server has 62, and Developer Tools round out the top categories with 22. SharePoint Server, Azure, Skype for Business, and Exchange Server account for the remainder. The volume is a direct signal: your Windows estate is the primary attack surface this month.
Which two zero-days are already being exploited?
Both actively exploited flaws are local privilege escalation bugs. Neither requires network access or user interaction. An attacker who already has a foothold on a machine uses them to jump from a low-privilege user to SYSTEM.
CVE-2026-85880 (CVSS 7.8) is a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem. Microsoft's advisory warns that an attacker executing code in a low-privilege AppContainer can escape the sandbox and elevate privileges with no additional user interaction. Tenable notes this is the second ALPC zero-day weaponized since CVE-2023-21674, which was patched in January 2023.
CVE-2026-81963 (CVSS 7.8) is an improper link resolution flaw in the Windows Update Stack. The component responsible for installing Windows updates can be tricked into following a malicious link and overwriting a system component with an attacker-controlled imposter. Tenable reports this is the first Windows Update Stack zero-day to be exploited in the wild, though there have been seven privilege escalation flaws in that component since 2022. Rapid7's Adam Barnett noted that all supported Windows versions receive a patch that presumably tightens those link controls.
The U.S. Cybersecurity and Infrastructure Security Agency added both to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply fixes by September 22, 2026.
How bad is the deployment crisis for operators?
Bad. The core problem is not the severity of individual bugs. It is the sheer volume. Tyler Reguly, associate director of security research and development at Fortra, told Krebs on Security that Windows updates must be tested before deployment because third-party software does not always play nice with OS changes. When you ship nearly a thousand patches at once, your testing window compresses to the point of failure.
This is the math that keeps IT leads awake. If you are responsible for patching 50,000 endpoints, a 974-CVE drop is not a Tuesday afternoon job. It is a multi-week logistics operation. Reguly's advice is blunt: CISOs and CSOs need to resource their teams for weekend patch deployments, or risk leaving critical flaws unpatched while tests drag on.
The exposure is not theoretical. Dustin Childs of the Zero Day Initiative flagged 20 wormable vulnerabilities in this batch, meaning they enable remote code execution without authentication or user interaction. One of the scariest is CVE-2026-69829, a critical RCE in the Windows Shell with a CVSS base score of 9.8. It can be exploited with low attack complexity, no privileges, and no user interaction. Another is CVE-2026-69730, a DNS weakness in Windows Server 2012 onward that an unauthenticated attacker can trigger by sending a single crafted packet.
What should I patch first and how?
Prioritize by exploitability and blast radius. The two zero-days (CVE-2026-85880 and CVE-2026-81963) are your immediate targets. They are confirmed exploited in the wild. CISA's September 22 deadline is a useful forcing function, but you should treat it as the backstop, not the goal.
Here is a practical triage order for your environment:
- Patch the two zero-days immediately. They affect all supported Windows versions. If you have endpoint detection and response tooling, ensure your EDR is blocking unexpected child processes of ALPC and Windows Update Stack components while patches roll out.
- Patch Exchange Server and SharePoint next. Dustin Childs flagged CVE-2026-55007 (RCE in Exchange Server) as the most important patch for the messaging server. CVE-2026-69465 is an RCE in SharePoint. Both are internet-facing services that attackers probe constantly.
- Patch Remote Desktop Services. CVE-2026-69525 is an RCE in RDS. Any exposed RDS endpoint is a ransomware waiting to happen.
- Patch SQL Server. CVE-2026-65669 is an elevation of privilege flaw in SQL Server. Database servers are high-value targets.
- Deploy Servicing Stack Updates. Microsoft shipped critical SSUs for Windows Server 2012, Windows Server 2012 R2, and Windows 10 Version 1607 / Server 2016. You need these before you can deploy the security patches.
If you have legacy or out-of-support systems in your estate, the risk is even higher. A threat actor who establishes a beachhead via an exposed RDS flaw or a phishing-driven Exchange exploit can then use CVE-2026-85880 or CVE-2026-81963 to escalate to SYSTEM and move laterally. This is the exact chain that leads to ransomware deployment.
For teams looking to automate triage, we have previously covered how CISA KEV vulnerabilities put edge gear on watch, and the same logic applies here. If a flaw is on the KEV catalog, it is being exploited. Treat the catalog as your minimum patch list.
What is the broader signal in this record batch?
Microsoft itself attributes part of the discovery acceleration to artificial intelligence. As Krebs on Security reports, the company says AI is speeding up vulnerability discovery. That is a double-edged sword for operators. More discovered flaws means more patches, which means more testing, which means more deployment fatigue. The patch pipeline is already struggling to keep up, and AI-driven discovery will only widen the gap between what Microsoft ships and what teams can deploy.
This trend has serious implications for how you structure your security operations. If you are still treating patching as a monthly, manual, after-hours exercise, the model is breaking. You need automated patch prioritization based on threat intelligence, not CVSS scores alone. A CVSS 7.8 zero-day under active exploitation is a higher priority than a CVSS 9.8 theoretical RCE in a component no attacker is currently targeting. But the current volume makes even that prioritization hard to execute manually.
Rapid7's analysis reinforces this shift. As their Patch Tuesday assessment notes, no serious attacker will bother developing an intricate one-shot RCE when a two-stage attack chain consisting of low-privileged local access coupled with elevation of privilege will achieve the same goal much more easily. The two zero-days in this batch are both EoP bugs. That is the pattern to watch.
The bottom line for operators
Microsoft shipped nearly a thousand patches in a single day. Two are already being exploited. Twenty are wormable. Your testing pipeline is the bottleneck, not Microsoft's release schedule. If you cannot patch everything immediately, patch the two zero-days and the internet-facing RCEs first. Everything else can follow a rational, tested rollout. But the era of the manageable monthly patch batch is over. Build your automation now, or prepare to spend every weekend catching up.
