Press play to start listening
Microsoft released its September security updates on September 8, fixing 966 vulnerabilities in what is now its largest Patch Tuesday release on record. Independent security firms reported slightly different totals, with CrowdStrike counting 972 CVEs and Tenable reporting 964. The differences reflect how researchers count vulnerabilities included in the release, but all three figures confirm the unusually large scale of this month’s update.
The 966-issue release includes 105 Critical vulnerabilities, while 258 are remote code execution (RCE) flaws and 438 involve elevation of privilege. The unusually high number of fixes follows several large Microsoft security releases this year, alongside increased use of AI-assisted techniques to identify vulnerabilities across major software platforms.
Two Windows Zero-Days Were Exploited
Microsoft said both flaws were already being exploited when the patches were released. CVE-2026-81963 affects the Windows Update Stack and can let a local attacker gain SYSTEM privileges by exploiting improper link resolution. The vulnerability requires local access rather than providing an unauthenticated route from the internet.
The second flaw, CVE-2026-85880, is in Windows Advanced Local Procedure Call (ALPC). The heap-based buffer overflow can be abused by an attacker with code execution inside a low-privilege AppContainer to break out of the sandbox and reach SYSTEM privileges. No additional user interaction is required.
The distinction is important: neither zero-day is a standalone remote-entry vulnerability. Instead, both can help an attacker increase privileges after gaining an initial foothold on a Windows system. Both exploited zero-days carry a CVSS score of 7.8, although the September release also includes Critical vulnerabilities with higher CVSS ratings.
Critical Bugs Reach Core Network Services
The update also fixes critical flaws in several Windows networking services, including DNS Server, DHCP Server, Netlogon, Message Queuing, Network File System and SSTP. CrowdStrike found that at least 17 of these RCE flaws could be reached over the network without authentication, putting exposed systems at risk.
Office is another major part of the update. Microsoft patched 22 Critical vulnerabilities in Office and graphics components, including 12 that could be triggered through the Outlook Reading Pane or Windows Explorer’s Preview Pane, potentially allowing code execution when a malicious file is previewed without the user opening it or clicking an attachment.
Windows Hyper-V was another significant area of concern. Several vulnerabilities allow guest-to-host attacks, potentially allowing a compromised virtual machine to cross the hypervisor isolation boundary and expose the virtualization host and other co-resident virtual machines.
The security workload may not end with this month’s patches. Roughly two hours after Microsoft released its September updates, a researcher using the MSNightmare persona published a proof-of-concept exploit targeting Microsoft Defender, dubbed ShieldCrash.
The researcher claims Microsoft’s earlier fix for the ShieldBreak vulnerability, CVE-2026-69414, left another attack path open that allows SYSTEM-level file reads and could be developed into full SYSTEM privilege escalation. CrowdStrike said the claims are still under review and analysis is ongoing. The issue is separate from the vulnerabilities fixed in September’s Patch Tuesday release.
Expert Commentary:
Commenting on September’s unusually large Microsoft security release, Tyler Reguly, Associate Director of Security R&D at Fortra, shared insights with Hackread.com, stating the growing number of vulnerabilities should be viewed as part of a broader effort by major technology vendors to reduce their attack surface.
“We need to remember that these large CVE counts are a good thing as we’re reducing attack surface before attackers get a chance to find and utilize the vulnerabilities.”
On the pressure such a large release can place on patching processes, Reguly said:
“This is a great time to consider if your processes are designed to handle major changes and potential patching bottlenecks.”
Reguly urged organizations not to sacrifice testing while trying to deploy patches quickly:
“Patches still need to be tested because not all vendors can be trusted, and many have broken the trust they had previously gained. Test your patches before you deploy them.”
He also highlighted the workload faced by security teams handling large patch releases:
“Support your team, be aware of the difficulties they face, and ask them how things can be improved.”
