Microsoft’s September 2026 Patch Tuesday has landed — and it’s one for the history books. This month’s security update drops fixes for approximately 966 vulnerabilities across Windows, Microsoft Office, SQL Server, and developer tools, making it the largest Patch Tuesday release on record. Among those fixes are two actively exploited zero-day vulnerabilities already being used by attackers in the wild, compounding pressure on enterprise administrators worldwide to act fast.
The sheer volume of patches is hard to overstate. Depending on counting methodology, security researchers at firms including Tenable, Qualys, SecurityWeek, and CrowdStrike have tallied the total anywhere between 964 and 974 CVEs — figures that dwarf previous record months. Whatever the exact count, the message is clear: September 2026 is a brutal month to be a Windows sysadmin.
Two Zero-Days Already Under Active Exploitation
The most urgent items on this month’s list are two vulnerabilities that Microsoft confirmed were actively exploited before today’s patches were released.
CVE-2026-85880 — Windows Advanced Local Procedure Call (ALPC) Heap Buffer Overflow
This vulnerability affects the Windows Advanced Local Procedure Call subsystem, a core inter-process communication mechanism built into every version of Windows. The flaw is a heap buffer overflow that allows a local attacker with code execution in a low-privilege AppContainer to escalate their privileges all the way to SYSTEM level. In practice, this makes it an extremely attractive post-exploitation tool for threat actors who have already gained an initial foothold through phishing, malware, or another vulnerability.
The privilege escalation chain is particularly dangerous in enterprise environments where attackers frequently gain initial access through end-user accounts with limited permissions. CVE-2026-85880 lets them jump from that low-privileged position to full control of the machine in a single step.
CVE-2026-81963 — Windows Update Stack Link-Following Vulnerability
The second zero-day resides in the Windows Update Stack — the set of components responsible for downloading and installing Windows updates. This flaw is classified as an “improper link resolution before file access” vulnerability, commonly called a link-following or symlink-following bug. An attacker who can create symbolic links on the system could potentially redirect file operations performed by the Update Stack to overwrite sensitive system files or escalate privileges.
That this vulnerability sits inside the update mechanism itself carries a certain grim irony. The very system designed to keep Windows machines secure has become a vector for attack.
Both vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, and Federal Civilian Executive Branch agencies have been given a hard deadline of September 22, 2026, to apply the fixes.
The Scale of September’s Patch Load
Beyond the two zero-days, the September 2026 update addresses an extraordinary breadth of vulnerabilities. Of the total CVE count, approximately 113 are rated Critical by Microsoft. Breaking down the critical vulnerabilities by type: 81 are Remote Code Execution flaws — the highest-severity class, allowing attackers to run arbitrary code on victim machines without physical access; 20 are Elevation of Privilege vulnerabilities; 2 are Information Disclosure flaws; and 1 is a Security Feature Bypass.
The total does not include an additional 204 vulnerabilities that Microsoft patched earlier this month through out-of-band updates to cloud services including Azure AI Language, Azure Cosmos DB, Copilot Studio, and Entra ID. When those are included, the true September 2026 patch count approaches 1,170 CVEs, according to tracking by Senserva — making this arguably the most significant security month Microsoft has ever produced.
Adobe Also Drops Emergency Fixes: The StyleSmuggler Story
Microsoft wasn’t the only major vendor racing to plug critical holes this month. Adobe’s September patch release, which traditionally aligns with Patch Tuesday, addressed 170 vulnerabilities across its product portfolio — including an emergency fix for a zero-day that had already been actively exploited for days before the patch arrived.
The vulnerability, tracked as CVE-2026-75650 and nicknamed StyleSmuggler by the Dutch e-commerce security firm Sansec, carries a perfect CVSS score of 10.0. It affects Magento Open Source and Adobe Commerce versions 2.4.4 through 2.4.9 — essentially every modern release — and allows unauthenticated remote code execution with no user interaction required.
StyleSmuggler works by abusing Magento’s template rendering system. Attackers inject malicious PHP code through the “Payment Transaction Failed Reminder” email generation pathway, triggering server-side code execution in a context that bypasses normal authentication and privilege controls. Sansec first observed active exploitation on September 4, 2026, and published a warning advisory the following day specifically because online stores were being compromised in real time. Adobe issued its emergency hotfix on September 7 — three days after attackers had already begun their campaign.
The implant dropped by StyleSmuggler is technically sophisticated: a statically linked Rust binary compiled for both x86-64 and arm64 Linux, roughly 1.9 MB in size. It disguises itself as a legitimate Linux kernel thread to evade casual process monitoring, installs a cron entry that restarts it every five minutes, and writes directly to the cron spool file rather than using the normal crontab command — a deliberate technique to avoid the log entries that standard crontab modifications would generate. For merchants running Magento or Adobe Commerce, the recommendation is immediate patching.
What This Means for Enterprise Security Teams
The September 2026 patch cycle puts enterprise security teams in a difficult position. The volume of patches is unprecedented, but the presence of two actively exploited zero-days in core Windows infrastructure means triage cannot wait for a leisurely rollout schedule. Organizations typically stage Patch Tuesday updates to catch compatibility regressions — testing patches on a subset of machines before deploying broadly. The actively exploited status of CVE-2026-85880 and CVE-2026-81963, combined with the CISA KEV deadline, effectively compresses that window to near zero for government agencies and heavily regulated industries.
Security teams should prioritize immediate deployment of patches for CVE-2026-85880 and CVE-2026-81963 across all Windows endpoints, particularly any internet-facing systems or those with sensitive data access. Teams should also audit for signs of exploitation — looking for unexpected privilege escalations, new scheduled tasks, or unusual ALPC-related event log entries from before today’s patch date. Adobe Commerce and Magento administrators should treat the StyleSmuggler patch as an emergency even if they believe their store has not been targeted, and conduct forensic checks for the Rust implant described in Sansec’s advisory.
The Bigger Picture: A Software Industry Under Pressure
The record patch count for September 2026 isn’t happening in a vacuum. Microsoft has been scaling its AI-driven code generation and copilot-assisted development tooling aggressively across its entire product surface, and security researchers have noted that rapid AI-assisted feature development can introduce vulnerabilities faster than traditional security review processes catch them. The company’s Secure Future Initiative has produced measurable results in some areas — Azure-related patching velocity has improved — but the raw CVE volume suggests that the underlying attack surface continues to expand faster than it can be hardened.
Oracle and SAP, who align their own patch cycles to Patch Tuesday week, also released updates this month, though neither matched the scale of Microsoft’s release.
For Windows administrators, September 2026 will be remembered as the month the patch pile became almost unmanageable. The industry’s continued reliance on legacy Windows infrastructure — even as modern Linux and cloud-native alternatives gain share — means that Microsoft’s security velocity directly affects the security posture of millions of organizations worldwide. This month’s record suggests that velocity is not yet fast enough.
Sources: BleepingComputer, SecurityWeek, Tenable, Qualys, CrowdStrike, Arctic Wolf, CSO Online, Sansec, The Hacker News, CISA KEV Catalog
