Microsoft's September 2026 Patch Tuesday fixes record 966 flaws, two actively exploited zero-days

The September 2026 Patch Tuesday addresses 105 flaws rated “Critical,” with 81 of those involving remote code execution. Overall, the update covers 438 elevation of privilege vulnerabilities, 258 remote code execution flaws, 173 information disclosure bugs, 56 denial of service vulnerabilities, 19 security feature bypass issues, and 16 spoofing vulnerabilities.

The two actively exploited zero-day vulnerabilities patched this month are:

CVE-2026-81963 – An elevation of privilege vulnerability in the Windows Update Stack that allows attackers to gain SYSTEM privileges. Microsoft described it as “improper link resolution before file access (link following)” and credited Romain Deperne along with the Microsoft Threat Intelligence Centre (MSTIC) for reporting it. No details on how the flaw has been exploited publicly were shared.
CVE-2026-85880 – A Windows Advanced Local Procedure Call (ALPC) elevation of privilege vulnerability (additional details are limited in the source).

According to BleepingComputer, Microsoft has attributed the surge in Patch Tuesday volume to an AI-powered vulnerability discovery system that identifies more flaws across its software. The total does not include 204 additional bugs fixed earlier this month in products such as Azure AI Language, Azure Cosmos DB, Copilot Studio, Entra ID, and Microsoft Edge (Chromium-based).

Organisations are advised to prioritise deployment of the zero-day patches given active exploitation, while also planning update cycles to manage the unprecedented volume of fixes.

Why This Matters

The record volume of patches signals a fundamental shift in Microsoft’s vulnerability detection capability, likely straining IT teams that must test and deploy updates rapidly.
Two actively exploited zero-days pose immediate risk to Windows users, especially in enterprise environments where unpatched systems could be leveraged for lateral movement.
The AI discovery system means future Patch Tuesdays may continue to deliver large fix batches, requiring organisations to reassess patch management processes.

Background

Microsoft has issued monthly “Patch Tuesday” security updates for decades, typically fixing dozens to hundreds of flaws per release. Starting in 2025, the company began deploying an AI-powered vulnerability discovery system to scan its codebase and third-party components more thoroughly. This has dramatically increased the number of vulnerabilities reported and patched: July 2026 saw 570 fixes, August had 400, and September now sets a new record at 966. The approach aims to get ahead of attackers by finding flaws before they are weaponised, but it also increases the operational burden on customers.

Key Perspectives

Microsoft: The company argues that proactive bug discovery—even at high volumes—reduces attacker opportunity windows and improves overall security posture. The AI system is positioned as a necessary evolution in software assurance. Enterprise IT and security teams: Many administrators face resource constraints; deploying hundreds of patches monthly forces difficult trade-offs between coverage and testing. The two zero-days require urgent action, but testing remains essential to avoid system disruptions. Critics/Skeptics: Some security researchers worry that the AI discovery system may produce high false-positive rates or surface low-risk bugs that still require patch deployment. Others question whether Microsoft is adequately prioritising fix quality over quantity.

What to Watch

Whether next month’s Patch Tuesday maintains the 900+ count or returns to lower levels after a backlog is cleared.
Exploit activity around the two zero-days: if proof-of-concept code appears, real-world attack volumes may spike.
Adoption of Microsoft’s cloud-based patch management tools (e.g., Windows Autopatch) to alleviate on-premises deployment burdens.

ZOTPAPER