Microsoft fixes 974 vulnerabilities in its largest Patch Tuesday, with two zero-days already exploited

Microsoft has published the September 2026 security package with a volume that surpasses any previous Patch Tuesday. The official guide gathers 974 vulnerabilities in own products. Incorporating another 25 non-Microsoft CVEs included in the update brings the full count to 999.

The difference explains why some analyzes speak of 974 failures and others are close to a thousand. Different counts also appear when you exclude Azure vulnerabilities resolved directly by Microsoft or group the same issue present in multiple versions. The most consistent reference is 974 Microsoft vulnerabilities and 999 fixes counted in total.

Windows concentrates 723 package vulnerabilities

Windows receives the most fixes, with 723 vulnerabilities. Office and Office 2016 accumulate 111, SQL Server appears with 62 and the development tools total 22. The rest is distributed between Azure, Exchange Server, SharePoint Server, Entra ID, Microsoft Authenticator, Skype for Business and other business components.

package size requires separating the volume from the effective risk. An organization will not have every affected product installed or be exposed to every attack scenario. However, there are remote code execution flaws in network services and more than a hundred vulnerabilities considered critical in different counts. Systems managers will need to review which servers, workstations, and applications are present before establishing the deployment order.

The most common types are elevation of privilege, remote code execution, and information disclosure. The three categories concentrate nearly 90% of the problems addressed. This complicates the upgrade for companies that simultaneously maintain Windows desktops, SQL servers, collaboration tools, and Microsoft 365 applications.

Two Windows vulnerabilities were already used in attacks

The immediate priority falls on CVE-2026-85880 and CVE-2026-81963two elevation of privilege vulnerabilities that Microsoft confirms as being actively exploited. Both have a CVSS score of 7.8 and require the attacker to be able to execute code locally, so they are not remote entry on their own. Its usefulness appears after gaining first access with limited permissions.

CVE-2026-85880 affects Advanced Local Procedure Call (ALPC)the Windows interprocess communication mechanism. A heap-based buffer overflow allows you to escape a low-privileged AppContainer and achieve SYSTEM permissions. Exploitation requires no additional user interaction. ALPC is part of all supported versions of Windows, so the patch should reach workstations and servers.

CVE-2026-81963 resides in Windows Update Stack and derives from incorrect link resolution. A locally authorized attacker can exploit this to elevate privileges to SYSTEM, manipulating the way the update stack follows a link and replaces a component. Microsoft has distributed the fix for all versions of Windows that continue to be supported.

DNS, Remote Desktop and SQL Server require attention

Among the errors with the highest scores are multiple CVSS 9.8 vulnerabilities capable of allowing remote code execution. They affect Windows Remote Desktop Services, Windows DNS Server, Windows DHCP Server, the NFS ONCRPC XDR driver, and Windows Shell. Its presence in network-accessible services makes it advisable to first check exposed systems or systems located in sensitive segments.

SQL Server incorporates an injection vulnerabilityidentified as CVE-2026-65669 and rated 9.6, which allows elevation of privileges to an unauthenticated attacker over the network. Exchange Server fixes CVE-2026-55007, a double free memory issue that can lead to remote code execution. SharePoint Server receives a fix for CVE-2026-69465, exploitable by an authenticated user and rated 8.8.

Office deserves a separate review. Of its critical vulnerabilities, a dozen can be activated from the preview or read panel. This reduces the interaction required to attempt to exploit malicious documents and suggests updating productivity applications alongside Windows, rather than considering the intervention complete after installing only the cumulative operating system update.

Microsoft distributes the fixes using Windows Update, Microsoft Update Catalog, and common corporate tools. In managed environments, it is advisable to start with the two exploited flaws, continue with services accessible from external networks and then address Exchange, SharePoint, SQL Server and Office according to their actual presence. Test rings are still necessary, but active use of the two zero-days discourages delaying general deployment without proven cause.