Microsoft's September 2026 Patch Tuesday, released Tuesday afternoon, fixes 966 vulnerabilities, the largest single security update the company has ever shipped, and two of them are already being exploited in live attacks. Both zero-days are elevation-of-privilege bugs: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in the Windows ALPC subsystem, and Microsoft is telling admins to have KB5122871 and KB5122876 installed within 24 hours, not the usual patch-this-week window. The record count keeps climbing month over month this year, and that trend is the part worth paying attention to.
- 966 flaws fixed in one release, up from 570 in July and 200 in June, with 105 rated critical, including 81 remote code execution bugs.
- Two zero-days are under active exploitation right now: CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows ALPC), both CVSS 7.8 privilege-escalation flaws that hand an attacker SYSTEM access once they already have a foothold.
- Microsoft attributes part of the surge to an AI-powered vulnerability-discovery system that is now finding far more flaws across its products than manual review ever did.
- Elevation-of-privilege bugs dominate the batch at 438, more than the next three categories combined, which tells you what attackers are chaining after their initial break-in.
What did Microsoft actually patch this month?
The September release covers Windows, Office, Azure, SQL Server, and Microsoft's developer tools, and breaks down into 438 elevation-of-privilege flaws, 258 remote code execution bugs, 173 information-disclosure issues, 56 denial-of-service bugs, 19 security-feature bypasses, and 16 spoofing flaws. That is not a typo on the EoP number. Nearly half the entire release is bugs that let someone who already has a toehold on a machine climb to full SYSTEM privileges, which is exactly the flaw class ransomware crews and post-exploitation frameworks live on.
RelatedMicrosoft Patches 570 Flaws, Two Zero-Days Exploited
How are the two zero-days actually being exploited?
CVE-2026-81963 lives in the Windows Update Stack and stems from improper link resolution before file access, the bug class security researchers call link-following. An attacker who already has a low-privilege presence on a machine can abuse it to get the Update Stack to touch a file it shouldn't, and ride that into SYSTEM. Romain Deperne and Microsoft's own MSTIC team get credit for catching it. CVE-2026-85880 is a heap-based buffer overflow in ALPC, the interprocess-communication mechanism Windows components use to talk to each other internally, and it was flagged by Volexity and researchers at Proofpoint. Neither one is remotely exploitable on its own; both need an attacker to already be running code on the box. That is precisely why they matter: they're the second stage, the move that turns a phishing click or a web-shell drop into full administrative control.
Why does a 966-count release matter beyond the headline number?
A record number by itself is a vanity metric. What it signals is the more interesting story: Microsoft says an AI-assisted vulnerability discovery system is now surfacing far more flaws across its codebase than the old manual triage process caught, and the monthly totals back that up. June ran 200. July jumped to 570. September lands at 966. That is not noise, it is a step function, and it means the same automated tooling finding these bugs internally is presumably available, in some form, to anyone probing Microsoft's products from the outside too. More disclosed flaws is good news if it means real bugs get fixed before attackers find them first. It is bad news for IT teams whose patch cadence was already stretched thin at 570 a month.
Who needs to act, and how fast?
Anyone running Windows, whether a home laptop on automatic updates or a fleet of servers on a change-control schedule, is affected by something in this release. The two zero-days are the priority: get KB5122871 and KB5122876 installed within 24 hours if you manage endpoints, because Microsoft is not being cautious with that language by accident. Enterprises running the Windows Update Stack or ALPC-dependent management tooling should also check whether their patch orchestration itself depends on components this release touches, since a broken update pipeline is its own kind of outage. Consumers on automatic updates are largely covered once Windows finishes installing overnight, but it is worth confirming Windows Update actually ran rather than assuming it did.
RelatedMicrosoft Just Shipped Its Largest Patch Tuesday Ever, and That Is Not Good News
| CVE-2026-81963 | CVE-2026-85880 | |
|---|---|---|
| Component | Windows Update Stack | Windows ALPC |
| Flaw type | Improper link resolution (link-following) | Heap-based buffer overflow |
| CVSS | 7.8 | 7.8 |
| Credited to | Romain Deperne, Microsoft MSTIC | Volexity, Proofpoint |
| Prerequisite | Local code execution already present | Local code execution already present |
| Fix | KB5122871 / KB5122876 | KB5122871 / KB5122876 |
What's next for Microsoft's patch cadence?
Nothing about this month suggests the count comes back down. If the AI-discovery system keeps finding flaws at this rate, October's Patch Tuesday could plausibly beat September's, and IT teams that treat Patch Tuesday as a once-a-month fire drill will keep falling further behind. The more durable fix is process, not heroics: automated patch testing pipelines, staged rollout rings, and treating "actively exploited" tags as the actual triage signal rather than working through 966 CVEs in title order.
- CISA KEV listing. Neither zero-day had appeared on CISA's Known Exploited Vulnerabilities catalog as of this writing; a federal deadline usually follows within days once it does.
- Public proof-of-concept code. Link-following and ALPC bugs are well-understood exploitation primitives; expect writeups and PoC repos within one to two weeks now that the technical details are public.
- October's count. If it lands anywhere near September's 966, the "record month" framing stops being a story and becomes the new baseline.
Our take
The zero-day count is the wrong headline. Two exploited flaws in a 966-bug release is a small percentage, and that's the point: attackers don't need to search hard when there's this much surface area to choose from. The real story is the shape of the curve across 2026, 200 in June, 570 in July, 966 in September, and a company telling you in public that automation is why. Faster bug discovery from the vendor is a genuine improvement over the old status quo of bugs sitting unfound for years. But it only pays off if patch operations scale at the same rate discovery does, and right now the evidence says they aren't. Prioritize the two actively exploited CVEs today, and treat the total count as a planning number for next month, not a scoreboard.
- OfficialMicrosoft Security Response Center, September 2026 Security Update Guide full CVE list, severity ratings, and affected products
- AnalysisBleepingComputer, "Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days" breakdown by flaw type and zero-day exploitation details
- ReferenceCISA Known Exploited Vulnerabilities Catalog check for CVE-2026-81963 and CVE-2026-85880 listings and federal patch deadlines
- TrackingGenZTech CVE Watchlist our running record of actively exploited vulnerabilities, updated per disclosure
Original analysis by GenZTech Team. Source: BleepingComputer.