Microsoft Patches Record 974 Vulnerabilities, Addressing Two Zero-Days

Microsoft’s latest release cycle set an all-time record with 974 patched CVEs across its software ecosystem, headlined by two active zero-days exploited in targeted attacks. Security teams evaluating the September Microsoft Patch Tuesday release face a massive volume of security advisories, led by critical local elevation of privilege flaws CVE-2026-85880 and CVE-2026-81963 alongside 20 wormable remote code execution vulnerabilities. The update addresses security defects spanning core Windows kernel components, enterprise server infrastructure, and desktop productivity suites.

The sheer volume of resolved issues highlights both the broadening scope of modern software audits and the persistent reliance of threat actors on local privilege escalation primitives to complete post-exploitation chains.

Dissecting the Active Zero-Day Flaws

The two zero-day vulnerabilities actively exploited in the wild both allow local attackers to escalate privileges to NT AUTHORITY\SYSTEM, the highest privilege tier on a local Windows host.

• CVE-2026-85880: A heap buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem. ALPC serves as the primary high-performance inter-process communication (IPC) mechanism within the Windows kernel, handling message passing between low-privilege applications and system services. Because applications running within restricted AppContainer sandboxes (such as modern web browsers or isolated productivity applications) retain access to ALPC endpoints to communicate with system services, memory corruption bugs in ALPC are prized escape primitives. An attacker who has achieved low-privilege code execution can leverage this flaw to trigger a heap overwrite, escape the AppContainer sandbox, and execute arbitrary code as SYSTEM without requiring any user interaction. This marks only the second ALPC zero-day resolved in nearly four years, following CVE-2023-21674 in January 2023.

• CVE-2026-81963: An improper link resolution (‘link following’) defect located within the Windows Update Stack, the underlying service framework responsible for fetching and staging system updates. Because the Windows Update engine runs under elevated system privileges, improper validation of file paths, hard links, or symbolic links enables unprivileged local users to redirect file operations. By planting crafted links prior to file access, an attacker can trick the installer stack into modifying, replacing, or executing malicious files in protected system directories, granting full SYSTEM access. This is the first zero-day discovered in the Windows Update Stack despite seven vulnerabilities being addressed in the component over the past five years.

In a typical attack scenario, an adversary combines an initial access technique—such as a phishing link or remote code execution bug—with these local zero-days. Once inside a low-privilege process, exploiting CVE-2026-85880 or CVE-2026-81963 allows them to disable local defenses, extract credentials from LSASS memory, and establish persistent administrative control across the endpoint.

High-Risk Targets and Wormable Flaws

Beyond the actively exploited zero-days, the release contains patches for 723 flaws in Windows and 222 in the Microsoft Office suite (including 111 impacting Office 2016). Broader server software also received heavy security patching: SQL Server (62 flaws), Developer Tools (22), SharePoint Server (16), Azure services (12), Skype for Business (10), and Exchange Server (9).

A critical subset of 20 newly resolved flaws are classified as wormable. These remote code execution (RCE) vulnerabilities require neither authentication nor user interaction, making them prime candidates for automated lateral movement across internal enterprise networks.

Key high-priority vulnerabilities identified for immediate remediation include:

• CVE-2026-55007: Remote Code Execution in Microsoft Exchange Server.
• CVE-2026-69465: Remote Code Execution in Microsoft SharePoint Server.
• CVE-2026-69525: Remote Code Execution in Remote Desktop Services (RDS).
• CVE-2026-65669: Elevation of Privilege in Microsoft SQL Server.
• CVE-2026-80097: Elevation of Privilege in Microsoft Authenticator.

Additionally, Microsoft released fresh Servicing Stack Updates (SSU) marked as critical for legacy and long-term support platforms, including Windows Server 2012, Windows Server 2012 R2, and Windows 10 Version 1607 / Windows Server 2016. SSUs modify the component that receives updates, ensuring machines can reliably process large security updates without installation failures.

AI Discovery Trends and Threat Context

The record count of 974 vulnerabilities reflects a growing industry trend toward AI-assisted vulnerability discovery and automated fuzzing. Security research teams and automated bug-hunting pipelines are generating significantly larger volumes of reportable flaws across long-standing codebases.

However, security researchers note that higher patch counts do not necessarily equate to a proportional surge in actual enterprise exposure. While AI tools are expanding the volume of identified security bugs, the subset of vulnerabilities that are reachable, weaponizable, and actively targeted in real-world campaigns remains relatively stable. The primary challenge for security operations centers (SOCs) is filtering out non-reachable lower-tier defects to concentrate resources on exposure points with direct exploit paths.

Proactive vendors are aggressively clearing out legacy security debt across deep system services, temporarily inflating Monthly Patch Tuesday statistics as older, complex attack surfaces are remediated.

Remediation Guidance

Organizations should immediately prioritize the deployment of patches addressing the zero-day vulnerabilities and unauthenticated RCE flaws:

1. Deploy SSUs First: Apply the latest Servicing Stack Updates to Windows Server 2012, 2012 R2, and Windows Server 2016 before attempting large-scale batch installation of the September cumulative update to prevent package deployment errors.
2. Prioritize Edge and Identity Assets: Immediately update internet-facing instances of Exchange Server (CVE-2026-55007), SharePoint Server (CVE-2026-69465), and Remote Desktop Gateway/Services (CVE-2026-69525).
3. Patch Endpoints for ALPC and Update Stack: Roll out the monthly cumulative Windows update across all desktop and server endpoints to eliminate zero-days CVE-2026-85880 and CVE-2026-81963.
4. Isolate Legacy Systems: If immediate patching of Exchange or SharePoint is restricted by maintenance windows, restrict inbound network access to trusted IP ranges and ensure local endpoint protection agents are active to detect AppContainer sandbox escapes.