Microsoft patches record 974 vulnerabilities, including two exploited zero-days

September 9, 2026 at 12:20 AM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Microsoft on Tuesday released patches for a record 974 CVEs across its products, including two vulnerabilities exploited in the wild as zero-days. The flaws affect Windows, Office, SQL Server, SharePoint, Azure, and Exchange Server. The update includes fixes for 20 wormable remote code execution vulnerabilities.

Key Facts

Microsoft released patches for 974 CVEs on Tuesday, a record number for the company.
Two of the patched vulnerabilities, CVE-2026-85880 and CVE-2026-81963, were exploited in the wild as zero-days.
The update includes fixes for 723 flaws in Windows and 222 in Office, including 111 in Office 2016.
20 of the resolved vulnerabilities are wormable, enabling remote code execution without authentication or user interaction.
CVE-2026-85880 is a heap buffer overflow in Windows ALPC, the second zero-day in that component in nearly four years.

Exploited Zero-Days

CVE-2026-85880 is a heap buffer overflow in the Windows Advanced Local Procedure Call (ALPC) that allows a local attacker to gain System privileges. Microsoft notes that an attacker executing code in a low-privilege AppContainer could exploit the flaw locally to escape the sandbox and elevate privileges without user interaction. Tenable senior staff research engineer Satnam Narang points out that Microsoft has not patched an ALPC flaw since April 2023, and CVE-2026-85880 is the second zero-day in the component in nearly four years, after CVE-2023-21674 in January 2023. CVE-2026-81963 is an improper link resolution before file access ('link following') defect in Windows Update Stack, also allowing local privilege escalation to System. Narang notes this is the first Update Stack security weakness flagged as a zero-day among the seven flaws resolved in the component over the past five years.

Patch Volume and Scope

Microsoft rolled out patches for 723 flaws in Windows and fixed 222 security bugs in its Office suite, including 111 in Office 2016. Multiple security issues were also addressed in SQL (62), Developer Tools (22), SharePoint Server (16), Azure (12), Skype for Business (10), and Exchange Server (9). The September 2026 Patch Tuesday updates include fresh Servicing Stack Updates (SSU) classified as critical, applying to Windows Server 2012, Windows Server 2012 R2, and Windows 10 Version 1607/Server 2016. ZDI's Dustin Childs highlights CVE-2026-55007 (remote code execution in Exchange Server), CVE-2026-80097 (elevation of privilege in Authenticator), CVE-2026-69465 (RCE in SharePoint), CVE-2026-65669 (EoP in SQL Server), and CVE-2026-69525 (RCE in Remote Desktop Services). According to Childs, 20 of the newly resolved vulnerabilities could be considered wormable, as they enable remote code execution without authentication or user interaction.