The September 2026 release is particularly significant because two Windows vulnerabilities were already being exploited in the wild before Microsoft released fixes. Both are local privilege-escalation flaws that can allow an attacker with an existing foothold to elevate privileges to SYSTEM, the highest level of access on Windows.

The two exploited vulnerabilities are:

• CVE-2026-85880 — Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege
• CVE-2026-81963 — Windows Update Stack Elevation of Privilege

Both vulnerabilities carry a CVSS score of 7.8 and have been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Federal Civilian Executive Branch agencies have been given until September 22, 2026, to remediate them.

September Sets a New Patch Tuesday Record

Microsoft's September release addresses 974 vulnerabilities, making it the company's largest single Patch Tuesday update to date.

The scale of the release is substantially larger than recent months:

Month	Microsoft Vulnerabilities Addressed
May 2026	161
June 2026	220
July 2026	457
August 2026	663
September 2026	974

Microsoft's release data identifies 723 vulnerabilities in Windows, 111 in Office and Office 2016, 62 in SQL, and 22 in Developer Tools. Additional fixes cover Exchange Server, SharePoint Server, Azure, Skype for Business and other products.

The exact number varies slightly between vulnerability trackers because organizations use different counting methodologies. For example, Tenable counts 964 CVEs, while other security researchers report 972. Microsoft's own release information is the basis for the 974 figure.

Regardless of the counting methodology, September represents an unprecedented volume of Microsoft security fixes.

Two Windows Zero-Days Are Already Under Attack

The most urgent vulnerabilities in the release are the two Windows flaws that Microsoft says have been exploited in attacks.

Unlike a vulnerability that is merely theoretical or publicly disclosed, these flaws have already been weaponized.

CVE-2026-85880 — Windows ALPC

Severity: Important
CVSS: 7.8
Type: Heap-based buffer overflow / Elevation of Privilege
Exploitation: Confirmed

CVE-2026-85880 is a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) mechanism.

ALPC is an internal Windows communication mechanism used by processes to communicate with one another.

An attacker who has already obtained the ability to execute code in a low-privilege AppContainer can exploit the vulnerability to escape the sandbox and elevate privileges to SYSTEM.

Microsoft states that no additional user interaction is required once the attacker is in a position to exploit the vulnerability.

Potential Attack Chain

Initial Access

↓

Low-Privilege Code Execution

↓

AppContainer Environment

↓

CVE-2026-85880 Exploitation

↓

Privilege Escalation

↓

SYSTEM-Level Access

This type of vulnerability is particularly valuable to attackers because privilege escalation can transform a limited foothold into complete control of a Windows system.

Microsoft credited Volexity and researchers from Proofpoint with reporting the flaw.

CVE-2026-81963 — Windows Update Stack

Severity: Important
CVSS: 7.8
Type: Improper Link Resolution / Elevation of Privilege
Exploitation: Confirmed

The second zero-day, CVE-2026-81963, affects the Windows Update Stack.

The vulnerability is caused by improper handling of links before file access, allowing an authorized attacker to perform local privilege escalation.

Successful exploitation can result in SYSTEM-level privileges.

The vulnerability is especially notable because security researchers say it represents the first Windows Update Stack vulnerability known to have been exploited as a zero-day.

Tenable has tracked seven privilege-escalation vulnerabilities affecting the Windows Update Stack since 2022, but CVE-2026-81963 is the first one in that component confirmed as exploited in the wild.

Microsoft credited Romain Deperne and the Microsoft Threat Intelligence Center (MSTIC) with discovering the issue.

Why Local Privilege Escalation Zero-Days Matter

Neither of the two exploited vulnerabilities provides a straightforward initial-entry mechanism for a remote attacker.

Instead, they are particularly useful after an attacker has already gained limited access.

A typical attack could look like:

Phishing / Exploit / Malware

↓

Initial Code Execution

↓

Low-Privilege Account or Sandbox

↓

Privilege Escalation Zero-Day

↓

SYSTEM

↓

Credential Theft / Persistence / Lateral Movement

This makes the vulnerabilities valuable as second-stage exploits.

Security researchers have noted that privilege-escalation flaws can be chained with other vulnerabilities to increase the impact of an intrusion.

CISA Adds Both Vulnerabilities to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both CVE-2026-85880 and CVE-2026-81963 to its Known Exploited Vulnerabilities catalog.

For U.S. Federal Civilian Executive Branch agencies, the required remediation deadline is:

September 22, 2026

The KEV designation provides an important prioritization signal for organizations outside the federal government as well.

When a vulnerability is both technically serious and confirmed to be exploited, organizations should generally prioritize remediation ahead of vulnerabilities with no evidence of active exploitation.

More Than 100 Critical Vulnerabilities

The September update contains more than 100 vulnerabilities rated Critical.

Microsoft's release covers a broad range of vulnerability classes, with privilege escalation, remote code execution and information disclosure representing the majority of the month's security fixes.

The scale of the release means organizations should not attempt to prioritize vulnerabilities based solely on CVSS score.

Instead, security teams should consider:

• Active exploitation
• Internet exposure
• Authentication requirements
• Attack complexity
• Business criticality
• Asset exposure
• Availability of mitigations
• Whether vulnerable software is installed
• Whether the affected system contains sensitive information

Other High-Priority Vulnerabilities

Several additional vulnerabilities in the September release deserve particular attention because of their severity or potential impact.

CVE-2026-55007 — Microsoft Exchange Server

CVSS: 8.1

A double-free vulnerability in Exchange Server can allow an unauthorized attacker to execute code over a network.

Exchange remains a particularly sensitive enterprise target because successful compromise can expose email, identities and organizational communications.

CVE-2026-69465 — SharePoint Server

CVSS: 8.8

A missing authorization vulnerability in Microsoft Office SharePoint can allow an authorized attacker to execute code over a network.

CVE-2026-65669 — SQL Server

CVSS: 9.6

An injection vulnerability in SQL Server could allow an unauthorized attacker to elevate privileges over a network.

CVE-2026-69525 — Remote Desktop Services

CVSS: 9.8

A use-after-free vulnerability in Windows Remote Desktop Services could allow an unauthorized attacker to execute code over a network.

CVE-2026-69595 — Windows Services for NFS

CVSS: 9.8

A use-after-free vulnerability in the Windows Services for NFS ONCRPC XDR Driver could enable remote code execution.

CVE-2026-69730 — Windows DNS Server

CVSS: 9.8

A use-after-free vulnerability affecting Windows DNS Server could allow an unauthorized attacker to execute code over a network.

CVE-2026-69829 — Windows Shell

CVSS: 9.8

A heap-based buffer overflow in Windows Shell could result in remote code execution.

CVE-2026-72979 — Windows DHCP Server

CVSS: 9.8

A use-after-free vulnerability in the Windows DHCP Server could allow remote code execution.

20 Vulnerabilities Could Be Wormable

Another significant concern is the presence of 20 vulnerabilities that researchers consider potentially wormable.

These flaws can allow remote code execution without requiring authentication or user interaction under certain conditions.

Wormable vulnerabilities deserve special attention because successful exploitation can potentially allow malicious activity to spread automatically from one vulnerable system to another.

Security teams should therefore identify whether vulnerable services are:

• Internet-facing
• Reachable from internal networks
• Exposed between network segments
• Used by multiple systems
• Running with elevated privileges

Record-Breaking Vulnerability Volume

The September release is not an isolated increase.

Microsoft has already patched more vulnerabilities in 2026 than in any previous year, with security researchers noting that the annual total has passed 2,600 vulnerabilities with several months still remaining.

Security researchers increasingly attribute part of this growth to improvements in AI-assisted vulnerability discovery.

As automated code analysis becomes more capable, researchers and vendors can identify vulnerabilities at a much greater scale.

This creates both benefits and challenges.

The Positive Side

More vulnerabilities discovered and patched means:

• Fewer exploitable weaknesses remain exposed
• Security teams receive fixes before attackers discover the same bugs
• Legacy vulnerabilities can be removed from the attack surface

The Challenge

The growing volume creates operational pressure:

• More patches to test
• More systems to inventory
• More change-management requirements
• Greater risk of missed vulnerabilities
• Increased difficulty determining which fixes require immediate action

Patch Volume Does Not Equal Risk

Despite the record number of vulnerabilities, security researchers caution against treating the total number as a direct measure of organizational risk.

A vulnerability affecting a rarely deployed component may pose less practical risk than a lower-scoring flaw affecting a widely exposed enterprise service.

Organizations should therefore move from:

"Patch everything based on CVSS."

toward:

"Prioritize based on exploitability + exposure + business impact."

For the September release, the two exploited zero-days should sit near the top of virtually every Windows vulnerability remediation program.

Recommended Actions for Security Teams

1. Deploy September Security Updates

Organizations should begin deploying Microsoft's September 2026 security updates immediately, with priority given to systems affected by the two exploited Windows zero-days.

2. Prioritize the Two Zero-Days

Ensure systems affected by:

• CVE-2026-85880
• CVE-2026-81963

are identified and remediated as quickly as operationally possible.

3. Identify Internet-Facing Services

Prioritize externally accessible systems running:

• Exchange Server
• SharePoint Server
• Remote Desktop Services
• DNS Server
• DHCP Server
• Other affected network services

4. Use Vulnerability Management Platforms

Security teams should correlate Microsoft's advisories with asset inventories from platforms such as:

• Tenable
• Qualys
• Rapid7
• Microsoft Defender Vulnerability Management

The objective should be to determine which vulnerable assets actually exist in the environment.

5. Hunt for Exploitation

Because two vulnerabilities have already been exploited, SOC teams should investigate endpoint telemetry for suspicious privilege escalation.

Look for:

• Unexpected SYSTEM-level processes
• Suspicious AppContainer activity
• Unusual process trees
• Abnormal child processes
• Unexpected service creation
• Credential dumping
• Persistence mechanisms
• Suspicious PowerShell activity

6. Review EDR Telemetry

Security teams should search historical EDR/XDR data for unusual privilege transitions involving Windows processes and applications.

Where possible, correlate:

Initial Access → Exploitation → Privilege Escalation → Persistence

7. Do Not Ignore Non-Windows Products

The record release also contains significant vulnerabilities affecting Office, SQL Server, Exchange, SharePoint, Azure and developer tooling.

Patch prioritization should therefore cover the organization's complete Microsoft technology stack rather than focusing only on Windows endpoints.

Bottom Line

Microsoft's September 2026 Patch Tuesday is unprecedented in scale, with 974 vulnerabilities addressed in a single release.

But the raw number is not the most important part of the story.

The immediate concern is that two Windows privilege-escalation vulnerabilities are already being exploited in real-world attacks.

Organizations should prioritize CVE-2026-85880 and CVE-2026-81963, deploy the relevant security updates, and investigate potentially affected systems for signs of exploitation.

At the same time, security teams should use the September release as an opportunity to strengthen risk-based vulnerability management. A record number of vulnerabilities does not mean every flaw presents the same level of danger.

The most effective strategy is to combine asset exposure, exploit intelligence, vulnerability severity and business impact to determine what needs to be fixed first.

September 2026 Patch Tuesday — Quick Reference

Item	Details
Microsoft vulnerabilities addressed	974
Windows vulnerabilities	723
Office / Office 2016	111
SQL vulnerabilities	62
Developer Tools	22
Exploited zero-days	2
CVE-2026-85880	Windows ALPC EoP
CVE-2026-81963	Windows Update Stack EoP
Zero-day CVSS	7.8 each
CISA KEV	Both listed
Potentially wormable flaws	20
Primary risk	Privilege escalation / RCE
Patch priority	Immediate