On 8 September 2026, Microsoft released the largest Patch Tuesday security update in its history, fixing around 970 vulnerabilities in its products. Different sources report slightly different figures — 974 and 964 CVEs are mentioned — but the scale is unprecedented either way. Two vulnerabilities are already being actively exploited by attackers; both allow privilege escalation to SYSTEM level on the local system. Among the remaining fixes are five critical remote code execution vulnerabilities with a CVSS score of 9.8 that affect key Windows server components. Organizations must immediately prioritize updating systems, starting with the actively exploited and critical vulnerabilities.
Two actively exploited vulnerabilities
The main threat comes from two zero-days that Microsoft has confirmed are being exploited in real-world attacks:
CVE-2026-85880 (CVSS 7.8) — a heap buffer overflow in the Windows Advanced Local Procedure Call (ALPC) component. The vulnerability allows an attacker running code in a low-privileged AppContainer to escape the sandbox and obtain SYSTEM privileges without any additional user interaction. This is the second ALPC vulnerability to be exploited as a zero-day — the first was CVE-2023-21674, patched in January 2023. CVE-2026-85880 was reported by Volexity and Proofpoint, which suggests the vulnerability is likely being used in targeted attacks, although Microsoft has not disclosed details about the attackers, the scale of the campaign, or confirmed victims.
CVE-2026-81963 (CVSS 7.8) — an improper link resolution vulnerability in the Windows Update Stack. Exploitation allows an authenticated attacker to escalate privileges to SYSTEM. A patch has been released for all supported versions of Windows. According to researchers, this is the first Windows Update Stack vulnerability to be exploited as a zero-day, even though seven privilege escalation issues have been found in this component since 2022. The vulnerability was reported by Romain Depenne from Airbus Helicopters and the Microsoft Threat Intelligence Center (MSTIC).
MSTIC’s role in discovering CVE-2026-81963 is noteworthy: this Microsoft division specializes in tracking state-sponsored and high-end threats. Combined with the fact that CVE-2026-85880 was discovered by Volexity — a company known for investigating APT campaigns — it is reasonable to assume both vulnerabilities have been used in targeted attacks. However, Microsoft has not confirmed attribution, the scale of exploitation, or any successful compromise of victims.
Critical vulnerabilities with CVSS scores of 9.6–9.8
In addition to the two zero-days, the September update fixes several critical vulnerabilities that enable unauthenticated remote code execution:
- CVE-2026-69525 (CVSS 9.8) — use-after-free in Windows Remote Desktop Services, unauthenticated remote code execution
- CVE-2026-69595 (CVSS 9.8) — use-after-free in the Windows Services for NFS ONCRPC XDR Driver, unauthenticated remote code execution
- CVE-2026-69730 (CVSS 9.8) — use-after-free in Windows DNS Server, unauthenticated remote code execution
- CVE-2026-69829 (CVSS 9.8) — heap buffer overflow in Windows Shell, unauthenticated remote code execution
- CVE-2026-72979 (CVSS 9.8) — use-after-free in Windows DHCP Server, unauthenticated remote code execution
- CVE-2026-65669 (CVSS 9.6) — injection in SQL Server, unauthenticated privilege escalation over the network
The concentration of use-after-free vulnerabilities in network server components — RDP, DNS, DHCP, NFS — deserves particular attention. Each of these issues allows an unauthenticated attacker to execute arbitrary code over the network, making them potential candidates for the development of network worms. Although, at the time of publication, there have been no reports of these vulnerabilities being exploited in real-world attacks, their criticality and network-based attack vector demand prioritized patching.
Other notable vulnerabilities
Other fixes with high CVSS scores include:
- CVE-2026-55007 (CVSS 8.1) — a double-free vulnerability in Microsoft Exchange Server, unauthenticated remote code execution. The Exchange Server update is already available.
- CVE-2026-80097 (CVSS 8.6) — an authentication flaw in Microsoft Authenticator that allows local privilege escalation
- CVE-2026-69465 (CVSS 8.8) — missing authorization in Microsoft Office SharePoint, remote code execution
The scale of the update in the context of 2026
The September release is the culmination of a trend observed throughout 2026. According to Microsoft, previous months delivered: 457 CVEs in August, 663 in July, 220 in June, and 161 in May. Researchers note that the total number of vulnerabilities fixed by Microsoft in 2026 has already exceeded 2,600 — more than double the previous record set in 2020 (1,245 CVEs) — and there are still three months left in the year.
According to a number of analysts, this growth is linked to the use of AI-based tools for vulnerability discovery and is a positive signal: the attack surface is shrinking before attackers have time to find and exploit these issues. Nevertheless, it is creating an unprecedented load on patch management processes for IT security teams.
Practical recommendations
With such a volume of updates, prioritization is critically important. The recommended course of action is:
- Immediately apply patches for CVE-2026-85880 and CVE-2026-81963 — both vulnerabilities are already being exploited. All supported Windows versions are affected.
- Within 48 hours update server components that contain vulnerabilities with a CVSS score of 9.8: DNS Server, DHCP Server, Remote Desktop Services, NFS, Windows Shell. These vulnerabilities are exploitable over the network and do not require authentication.
- Within a week update Exchange Server (CVE-2026-55007), SharePoint (CVE-2026-69465), and SQL Server (CVE-2026-65669).
- Check whether RDP, DNS, DHCP, and NFS services are exposed to the internet unnecessarily. Restrict network access to these services until patching is complete.
- For CVE-2026-85880, pay particular attention to systems where applications run in AppContainer: the vulnerability enables sandbox escape. Monitor anomalous privilege escalations of processes launched in restricted containers.
The September Patch Tuesday is not just a quantitative record; it is a qualitative challenge for vulnerability management processes. Two actively exploited privilege escalation vulnerabilities and five critical network RCEs with a score of 9.8 form a real attack surface that must be closed first. Organizations that are unable to update all systems at once should focus on these seven CVEs and restrict network access to vulnerable server services until the full patching cycle is completed.
