Microsoft Releases Record-Breaking 974 Security Updates, Including Two Actively Exploited Zero-Days
Microsoft's September 2026 Patch Tuesday addresses a record 974 vulnerabilities, including two zero-days under active exploitation, highlighting the growing challenge of patch management.
Microsoft Corp. has issued an unprecedented batch of 974 security updates, shattering its previous record for a single Patch Tuesday release. This massive update addresses numerous vulnerabilities across its Windows operating systems and other software, underscoring the escalating complexity of software security.
The sheer volume of patches released this month surpasses Microsoft's previous record of 570 set in July 2026, bringing the year-to-date total to over 2,600 vulnerabilities. This figure more than doubles the company's previous record-setting year in 2020, with three months still remaining in 2026.
Among the most critical fixes are two "zero-day" vulnerabilities, CVE-2026-81963 and CVE-2026-85880, which were actively exploited in the wild before being patched. Both flaws allow attackers to elevate their privileges on compromised Windows systems, posing a significant immediate threat.
In total, 113 of the vulnerabilities addressed were rated "critical," meaning they could be exploited by malware or attackers to gain complete control over a vulnerable Windows machine, often with minimal user interaction. Notable critical flaws include CVE-2026-69730, a DNS weakness affecting Windows Server and Windows 10, which Microsoft warns is likely to be exploited due to its ease of abuse. Another severe vulnerability, CVE-2026-69829, is a Windows Shell remote code execution flaw with a CVSS score of 9.8, exploitable with low complexity and no user interaction.
Microsoft attributes the increased pace of vulnerability discovery, in part, to artificial intelligence. However, security experts caution that while AI aids in finding flaws, the human-intensive processes of testing and deploying these patches remain a significant challenge for organizations. Tyler Reguly of Fortra highlights the strain on IT teams, emphasizing the need for careful planning and support for staff working extended hours to deploy updates.
Satnam Narang of Tenable notes that while the number of discovered vulnerabilities is rising, the number that will actually affect most organizations remains relatively low. He stresses the importance of prioritizing remediation based on risk context, focusing on vulnerabilities that are reachable and exploitable within a specific environment.
For regular Windows users, the advice remains to keep Windows Update enabled and to install patches promptly, as letting them accumulate can lead to larger, more disruptive update processes. Enterprise administrators are advised to monitor resources like askwoody.com for potential issues arising from the new patches, and the SANS Internet Storm Center offers detailed breakdowns of the updates by severity.
The trend of massive patch releases is not unique to Microsoft, with other major software vendors also reporting increased patch cadence, often crediting AI-assisted research. This escalating volume presents a continuous challenge for cybersecurity professionals tasked with maintaining secure systems in the face of an ever-growing threat landscape.
This latest report from Dark Reading confirms Microsoft's September Patch Tuesday addresses a record-breaking 974 CVEs, slightly exceeding previous counts. It reiterates the critical nature of two actively exploited vulnerabilities and highlights an additional 58 that are highly likely to be exploited, underscoring the urgency for organizations to apply these patches.
This updated report from CyberScoop clarifies that Microsoft's September Patch Tuesday addresses a total of 974 vulnerabilities, a slight increase from the 973 previously reported. The article also highlights that while AI is accelerating vulnerability discovery, there hasn't been a corresponding surge in actively exploited zero-days, a point echoed by multiple security researchers quoted in the piece.
This new article from The Register provides additional context on Microsoft's record-breaking September Patch Tuesday, noting that the 974 CVEs issued are not significantly fewer than the total number of CVEs Microsoft released in all of 2025. It also highlights a specific concern regarding CVE-2026-85046, a Chrome zero-day that Microsoft has yet to issue a security advisory for, despite Google having patched it and confirmed active exploitation. This lack of an advisory could leave Edge users vulnerable if they rely solely on Microsoft's official communications for threat awareness.
The new article from Rapid7 Blog provides further detail on the two zero-day vulnerabilities actively exploited in the wild, specifically CVE-2026-85880 affecting the Windows ALPC mechanism and CVE-2026-81963 in the Windows Update Stack. It also highlights uncertainty surrounding Microsoft Edge's patch for CVE-2026-85046, a V8 JavaScript engine zero-day, noting that a formal security advisory is still pending despite a patch being released.
The new article provides additional details on the specific vulnerabilities patched, including CVE-2026-85880, a heap-based buffer overflow in Windows ALPC, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack, both of which allow for local privilege escalation. It also notes that both flaws have been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, mandating immediate patching for federal agencies.
A new proof-of-concept, dubbed ShieldCrash, claims to bypass Microsoft's previous fix for CVE-2026-69414, allowing local attackers to read arbitrary files with SYSTEM privileges on patched Windows systems. While not a full exploit, this bypass could expose sensitive data by forcing Microsoft Defender to access protected files, a significant concern given the SYSTEM account's elevated permissions.
This latest report from Infosecurity Magazine details a record-breaking 974 CVEs addressed by Microsoft in its September 2026 Patch Tuesday, surpassing the 973 CVEs mentioned in the previous report. The update includes 119 critical vulnerabilities and two zero-days, underscoring the critical need for prompt patching.
The article provides further technical details on the two zero-day vulnerabilities addressed in Microsoft's September Patch Tuesday. CVE-2026-81963, a Windows Update Stack EoP flaw, and CVE-2026-85880, a heap-based buffer overflow in Windows ALPC, both allow local privilege escalation to SYSTEM. The Malwarebytes Labs report also includes instructions for users on how to apply patches and check their Windows update status.
This new advisory details CVE-2026-69449, a heap-based buffer overflow vulnerability affecting Windows BitLocker across numerous client and server versions. While Microsoft rates the vulnerability as 'Important' and 'Exploitation Less Likely' with no known in-the-wild activity, it allows for local or in-network arbitrary code execution. The vulnerability was addressed in the September 2026 Patch Tuesday cumulative updates.
A security researcher known as Chaotic Eclipse has released a proof-of-concept (PoC) demonstrating a new zero-day vulnerability in Microsoft Defender, dubbed ShieldCrash. This flaw is specifically a bypass for the patch addressing CVE-2026-69414 (ShieldBreak), which Microsoft had previously fixed. The researcher claims Microsoft's prior remediation was incomplete, allowing for continued exploitation under specific conditions, enabling arbitrary file reads as SYSTEM.
Microsoft has issued an emergency out-of-band patch (KB5129195) to address critical issues that arose following its September Patch Tuesday updates. These problems primarily affected Remote Desktop Services (RDS), causing instability, RDP connection failures, and unresponsiveness in related tools like MMC. The update also resolves issues impacting Hyper-V, Windows Subsystem for Linux, and USB audio devices that were also negatively affected by the initial September patches.