Microsoft Addresses Record 974 Vulnerabilities, Including Two Actively Exploited Zero-Days, in September 2026 Patch Tuesday

Microsoft has released a record-breaking 974 patches in its September 2026 Patch Tuesday update, addressing numerous vulnerabilities across its software portfolio. Among these are two critical zero-day flaws, CVE-2026-81963 (Windows Update Stack privilege escalation) and CVE-2026-85880 (Windows Advanced Local Procedure Call privilege escalation), which have been actively exploited in the wild. The U.S. CISA has added both to its Known Exploited Vulnerabilities catalog, urging federal agencies to apply fixes by September 22, 2026.