Microsoft’s September 2026 Patch Tuesday has landed with a force that sent shockwaves through the enterprise security community — and with good reason. The monthly security update addresses approximately 966 vulnerabilities across Microsoft’s product portfolio, making it the largest single Patch Tuesday in the company’s history. Two of those flaws are actively being exploited in the wild, putting pressure on organizations to patch immediately.
A Record That No One Wanted to Set
The numbers are staggering. Depending on the source, Microsoft’s September 2026 security update resolves between 964 and 996 Common Vulnerabilities and Exposures (CVEs), with most counts landing around 966. That eclipses every previous monthly Patch Tuesday release Microsoft has ever issued. For context, the June 2026 update — which was itself considered remarkable at the time — addressed roughly 198 vulnerabilities. September’s release is nearly five times larger.
Among the vulnerabilities addressed this month, 105 are rated Critical, making this update not just large in volume but densely packed with high-severity risk. Of those Critical flaws, 81 enable remote code execution (RCE), 20 allow elevation of privilege, two involve information disclosure, and one is a security feature bypass. Elevation of Privilege vulnerabilities dominate the overall release, accounting for nearly half of all patched issues — a pattern that reflects the increasingly sophisticated lateral-movement techniques used by modern threat actors.
The Two Zero-Days You Need to Patch Now
While the sheer volume of patches is unprecedented, security professionals are zeroing in on two vulnerabilities that are already being exploited in active attacks.
CVE-2026-85880: Windows ALPC Heap Buffer Overflow
The first zero-day is CVE-2026-85880, a heap buffer overflow in Windows Advanced Local Procedure Call (ALPC), Microsoft’s inter-process communication framework. An attacker who can execute code within a low-privilege AppContainer sandbox can exploit this vulnerability to escape the sandbox entirely and elevate to SYSTEM-level privileges on the affected machine — without requiring any additional user interaction.
The ALPC subsystem has long been a target for privilege escalation exploits, and this vulnerability underscores why the attack surface remains attractive. The attack is local rather than remote, meaning an attacker must already have some foothold on the target machine, but the ability to silently escalate to SYSTEM makes it an extremely valuable second-stage exploit in any intrusion chain.
CVE-2026-81963: Windows Update Stack Elevation of Privilege
The second actively exploited zero-day, CVE-2026-81963, resides in the Windows Update Stack itself. Successful exploitation allows an authenticated attacker to elevate privileges to SYSTEM. CISA has added CVE-2026-81963 to its Known Exploited Vulnerabilities (KEV) Catalog and has set a mandatory remediation deadline of September 22, 2026 for federal agencies — a signal that the vulnerability is being actively leveraged in targeted campaigns.
The fact that this flaw lives in the Windows Update Stack is particularly alarming from a systemic perspective. The update mechanism is the very vehicle organizations rely on to stay secure, and any weakness in that subsystem carries outsized risk.
Why September’s Patch Volume Is So High
Security researchers and Microsoft watchers have offered several explanations for the extraordinary volume of patches this month.
One factor is the increasing use of AI-assisted vulnerability discovery. Multiple security firms have confirmed that large language models and automated fuzzing tools are dramatically accelerating the pace at which researchers — both ethical and malicious — can identify software flaws. Microsoft itself has acknowledged that AI-assisted internal red-teaming contributed to a larger-than-usual discovery pipeline this cycle.
A second factor is the ongoing code consolidation happening across Microsoft’s product lines. As the company merges functionality from legacy systems into shared components for Windows 11, Azure, and Microsoft 365, the resulting code churn creates new attack surface. Shared libraries mean that a single underlying flaw can manifest as multiple distinct CVEs across different product surfaces.
Finally, there is the compounding effect of deferred debt. Some security researchers note that the spike reflects a backlog of issues that had been tracked internally but required coordinated third-party disclosure timelines to align before release.
What’s Affected
The September update spans virtually every corner of Microsoft’s ecosystem. Windows 10 and Windows 11 receive patches addressing dozens of components, including the kernel, networking stack, graphics subsystem, Bluetooth drivers, and Remote Desktop Services. Windows Server 2019, 2022, and 2025 are also heavily patched.
Office and Microsoft 365 components receive fixes for Excel, Word, Outlook, SharePoint, and Teams, several of which are rated Critical for RCE. Azure-connected services, including Azure Arc and Azure Virtual Desktop, also receive patches. Visual Studio, .NET, and the Windows Subsystem for Linux round out the coverage.
The breadth of this release means that virtually no Windows-based environment is unaffected. Organizations running mixed environments that include older Windows Server versions or legacy Office installations should treat this month’s update cycle with particular urgency.
Operational Considerations for IT Teams
Deploying a patch bundle of this magnitude is not a trivial undertaking. Enterprise IT and security teams face a compressed window to test, stage, and roll out nearly a thousand security fixes without introducing operational disruptions. Some organizations will need to prioritize ruthlessly, focusing first on the two actively exploited zero-days and the 81 Critical RCE vulnerabilities before working through the broader list.
Microsoft’s guidance recommends that organizations leverage Windows Update for Business and Microsoft Endpoint Manager to orchestrate staged rollouts. Cloud-first environments using Azure Policy and Intune have the advantage of automated compliance enforcement, but on-premises environments with heterogeneous hardware will require more manual coordination.
Security teams should also monitor for signs of exploitation matching the ALPC and Windows Update Stack patterns, even in patched environments, since the deployment lag between patch release and universal application can leave a meaningful window of exposure.
The Bigger Picture
September 2026’s record-breaking Patch Tuesday is not simply a data point about one month’s worth of bugs. It is a signal about the trajectory of software complexity, the acceleration of vulnerability discovery enabled by AI, and the compounding challenge of securing sprawling ecosystems that grow faster than they can be fully audited.
For defenders, the message is familiar but more urgent than ever: patch as fast as your change management process will allow, prioritize actively exploited vulnerabilities above all, and treat every unpatched system as a liability rather than a low-priority to-do item.
Microsoft has set a record this month. Organizations that don’t respond swiftly may find that threat actors set records of their own.
