Microsoft Releases Record-Breaking September Patch Tuesday with Fixes for 964 Vulnerabilities, Including Two Exploited Zero-Days

Microsoft's September 2026 Patch Tuesday addressed a record 964 vulnerabilities across its products, including 104 critical and 860 important flaws. Notably, the update included fixes for two actively exploited Windows zero-day elevation-of-privilege vulnerabilities (CVE-2026-85880 and CVE-2026-81963).

Context

Microsoft's Patch Tuesday is a monthly event where the company releases security updates for its software products. The September 2026 update is notable for its record number of vulnerabilities addressed, reflecting the increasing complexity of software security. Zero-day vulnerabilities are particularly concerning as they can be exploited before a fix is available.

Why it matters

The release of 964 fixes highlights the ongoing security challenges faced by software companies. Addressing critical vulnerabilities is essential to protect users from potential cyberattacks. The presence of zero-day exploits indicates that attackers are actively targeting these weaknesses, making timely updates crucial for system security.

Implications

Failure to apply these updates could leave systems vulnerable to attacks, potentially leading to data breaches or system compromises. Organizations, especially those reliant on Microsoft products, may need to enhance their security protocols. The ongoing identification of vulnerabilities suggests that cybersecurity will remain a critical focus for businesses and consumers alike.

What to watch

Users and organizations should prioritize applying the September updates to mitigate risks associated with the identified vulnerabilities. Monitoring for any reports of exploitation related to the patched zero-days will be important. Future Patch Tuesdays may continue to reveal high numbers of vulnerabilities as cyber threats evolve.