Microsoft’s September 2026 Patch Tuesday has arrived—and it has done so with a force that has left the security community equal parts impressed and alarmed. On September 8, Microsoft released security updates addressing a staggering 966 vulnerabilities across its product portfolio, officially shattering every previous record the company has ever set for a single monthly update. The release includes patches for two actively exploited zero-day vulnerabilities that attackers were already using in the wild, underscoring the urgency for enterprise IT teams to act quickly.
A Record That Already Feels Inevitable
To appreciate just how large this update is, consider the trajectory. In July 2026, Microsoft fixed 570 vulnerabilities—itself a remarkable number at the time. August brought 503 fixes. Now September has landed at 966, with 105 of those classified as Critical severity. That means in less than three months, Microsoft has patched well over 2,000 security flaws, more than many vendors address in years.
The 966-figure also does not tell the complete story. An additional 204 flaws were patched separately earlier in September through out-of-band updates covering cloud services including Azure AI Language, Azure Cosmos DB, Microsoft Copilot Studio, Microsoft Entra ID, Microsoft Edge, Microsoft Fabric, and Power Automate. Combined, that brings the true September total to approximately 1,170 resolved vulnerabilities—a figure that would have seemed unimaginable as recently as 2024.
Of the 105 Critical-rated vulnerabilities in this release, 81 involve remote code execution, 20 are elevation of privilege bugs, two are information disclosure flaws, and one is a security feature bypass. The sheer breadth of affected products—spanning Windows, Office, SharePoint, Exchange, SQL Server, Hyper-V, and dozens of developer tools—means that virtually no Windows-based enterprise escapes unscathed.
The Two Zero-Days That Demand Immediate Attention
Buried within the record-breaking total are two vulnerabilities that carry special urgency: both were actively exploited by threat actors before Microsoft issued patches, and both were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on September 8, the same day the fixes landed.
CVE-2026-81963: Windows Update Stack Elevation of Privilege Vulnerability. This flaw targets the Windows Update Stack—the very mechanism meant to keep systems current and secure. By exploiting this vulnerability, an attacker who already has a foothold on a system can escalate privileges all the way to SYSTEM level, the highest privilege tier on a Windows machine. That combination—low barrier to entry paired with maximum privilege gain—is precisely what makes elevation-of-privilege bugs so dangerous in post-exploitation phases. Security researchers noted that it had already been observed being chained with initial-access exploits to deliver ransomware payloads before the patch shipped.
CVE-2026-85880: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability. ALPC is a core Windows inter-process communication mechanism that has historically been a rich target for privilege escalation research. This new vulnerability follows a familiar pattern: an attacker with limited user-level access can exploit the flaw to gain higher privileges, enabling lateral movement, credential theft, and deeper persistence within compromised networks. Active exploitation of this bug was confirmed by Microsoft’s threat intelligence teams prior to disclosure.
CISA has directed all US federal civilian agencies to patch both zero-days by September 29, 2026. Security teams in the private sector are strongly encouraged to treat that same deadline as their own.
Breaking Down the Critical Vulnerability Categories
Beyond the zero-days, the 105 Critical vulnerabilities encompass some alarming categories.
Remote Code Execution (81 Critical RCEs). The most dangerous class of vulnerability, RCE flaws allow attackers to execute arbitrary code on a target machine without physical access. This month’s crop includes bugs in Windows networking components, Office document handling, and SQL Server. One notable entry affects Windows DNS Server, raising the spectre of a wormable attack scenario where a single compromised network node could propagate malware automatically across an organisation’s DNS infrastructure.
Elevation of Privilege (20 Critical EoPs). Beyond the two zero-days, Microsoft patched eighteen additional high-severity privilege escalation bugs across the Windows kernel, Active Directory, and various system services. These are the building blocks of sophisticated multi-stage attacks.
Security Feature Bypass (1 Critical SFB). A bypass in Windows Secure Boot was also addressed, continuing a theme from earlier in 2026 when a different class of Secure Boot vulnerabilities drew significant attention from the security research community.
Adobe Joins September’s Security Storm—Including a Magento Zero-Day
Microsoft wasn’t alone in issuing a major September security release. Adobe simultaneously published nine security advisories patching 170 vulnerabilities across Experience Manager, ColdFusion, Photoshop, Illustrator, Animate, Commerce, Acrobat Reader, and Campaign Classic. Fifty of Adobe’s fixes are rated Critical.
The most alarming entry in Adobe’s September release addresses StyleSmuggler (CVE-2026-75650)—an unauthenticated remote code execution zero-day in Adobe Commerce and Magento Open Source carrying a maximum CVSS score of 10.0. Discovered by Sansec researchers, the vulnerability had been actively exploited since at least September 4, four days before Adobe issued a patch. Attackers injected malicious PHP code into Magento’s email template system, triggering execution during a routine “Payment Transaction Failed Reminder” email. The payloads dropped were particularly sophisticated: a Rust-based Linux backdoor that establishes a command-and-control channel, plus a PHP web shell enabling arbitrary code execution. Adobe Commerce merchants running any version from 2.4.4 through 2.4.9 are affected and should apply patch VULN-39341 and rotate encryption keys immediately.
Why Patch Counts Keep Climbing
Security researchers have pointed to several structural factors driving the explosion in monthly CVE counts throughout 2026. The rapid proliferation of AI-assisted vulnerability discovery tools has dramatically shortened the time between a vulnerability existing and being found—both by defenders filing CVEs and by attackers probing for weaknesses. Microsoft’s expansion of its out-of-band cloud patching program means more flaws are caught and fixed in real time, swelling the monthly totals. And the sheer complexity of the modern Windows ecosystem—spanning legacy Win32 components, the .NET runtime, Azure integration layers, AI inference APIs, and hybrid cloud connectors—creates an ever-larger attack surface.
Some observers have raised concerns about whether the accelerating cadence of patches is itself introducing instability. August’s Patch Tuesday caused a documented conflict between KB5101684 and certain Dell driver configurations that led to unexpected shutdowns on affected hardware. IT administrators increasingly find themselves in the position of balancing the risk of an unpatched vulnerability against the operational risk of a rushed update that disrupts production systems.
What Enterprise Teams Should Do Right Now
For security and IT operations teams, the September 2026 Patch Tuesday presents a clear action plan.
Prioritise CVE-2026-81963 and CVE-2026-85880 above all else—both are under active exploitation, both lead to SYSTEM-level access, and CISA has issued a mandatory remediation deadline. Test and deploy those patches in your environment within days, not weeks.
Address the 81 Critical RCE bugs next, paying particular attention to any Windows DNS Server or SharePoint patches in your environment given the wormable risk profile attached to those components.
If your organisation operates Adobe Commerce or Magento, treat the StyleSmuggler patch as an emergency. Unpatched Magento stores are actively being backdoored right now. Apply VULN-39341 and rotate encryption keys before the next business day.
Finally, review your patch testing and deployment pipeline. With monthly totals potentially approaching 1,000 CVEs on a sustained basis, organisations that rely on manual patch review processes will simply fall too far behind. Automated patch validation workflows, combined with robust rollback capabilities, are no longer optional for enterprises that take security seriously.
The Bigger Picture
Microsoft’s September 2026 Patch Tuesday is more than a record—it is a signal. The complexity and interconnectedness of modern software ecosystems are producing vulnerabilities faster than the industry has ever had to manage before. The two zero-days at the heart of this release are a reminder that attackers are keeping pace, exploiting newly discovered flaws before patches can be prepared and distributed. As Windows 10’s extended support window closes in October and more organisations are pushed toward Windows 11 and cloud-managed environments, the stakes for staying current have never been higher. Nearly 1,000 patches in a single month is extraordinary. The question enterprise defenders must answer is whether their processes are extraordinary enough to match it.
