Microsoft Releases Record September 2026 Security Update, Patching 972 Software Vulnerabilities and Two Zero-Day Exploits

In one of the largest single-day security maintenance releases in software history, Microsoft has rolled out its September 2026 Patch Tuesday update, patching approximately 972 vulnerabilities across its products and services. The massive update addresses over 110 critical-severity flaws, spanning Windows OS components, Microsoft Office, Azure cloud services, Exchange Server, and SQL Server. Cybersecurity researchers noted that this release marks a new benchmark in monthly flaw discoveries, driven in part by AI-assisted vulnerability research tools.

Crucially, the security bulletin addresses two high-severity zero-day vulnerabilities that were confirmed to be actively exploited by cyber threat actors prior to the release of the patches. The first, tracked as CVE-2026-81963, is an elevation of privilege vulnerability in the Windows Update Stack caused by improper link resolution, which enables local authenticated attackers to gain SYSTEM-level access. The second zero-day, tracked as CVE-2026-85880, is an out-of-bounds write buffer overflow in the Windows Advanced Local Procedure Call (ALPC) kernel mechanism, which also allows local attackers to elevate privileges to SYSTEM.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added both zero-day flaws to its Known Exploited Vulnerabilities catalog, giving federal agencies and enterprise IT teams urgent deadlines to deploy the updates. IT administrators worldwide are being urged to prioritize these patches immediately, as unpatched systems remain highly vulnerable to privilege escalation and automated ransomware deployment.