Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
- ID
- 22654
- Status
- summarized
- Published
- 09 Sep 2026, 12:41 PM
- Fetched
- 09 Sep 2026, 3:29 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/microsoft-patches-record-974-flaws.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.5
- Created
- 09 Sep 2026, 3:34 PM
- Tags
- Audience
- developerssaas_startup_founders
What happened
Microsoft's September 2026 Patch Tuesday set a record with 974 vulnerabilities patched (999 including non-Microsoft CVEs), including two actively exploited Windows zero-days: CVE-2026-85880 (heap-based buffer overflow in Windows ALPC, CVSS 7.8) and CVE-2026-81963 (improper link resolution in Windows Update Stack, CVSS 7.8), both allowing local privilege escalation to SYSTEM. Over 110 flaws were rated critical, with privilege escalation, RCE, and information disclosure accounting for ~90% of patches.
Why it matters
If you or your team run Windows workstations or Windows Server, patch immediately for the two actively exploited zero-days—both let a local attacker escalate to SYSTEM, and CVE-2026-85880 specifically allows escaping an AppContainer sandbox with no user interaction. The sheer volume (974 flaws, 110+ critical) means triage is non-trivial; prioritize the two in-the-wild CVEs first, then critical RCEs on internet-facing services.
Discussion angle
The patch count has grown from 161 in May to 974 in September—worth discussing whether this volume signals a deeper quality problem at Microsoft and how teams should automate triage rather than manually reviewing hundreds of CVEs each month.