Microsoft September 2026 Patch Tuesday: 966 CVEs Fixed and Two Windows Zero-Days Actively Exploited — Patch Today

Microsoft just dropped the largest single security update in its history — and buried inside a mountain of 966 patches are two Windows zero-days that attackers were already exploiting before Microsoft even had a fix ready. If your organisation runs Windows — and in India, that is virtually every enterprise — September 2026 Patch Tuesday is the update you cannot afford to treat as routine.

A Record No One Wanted to Set: 966 Vulnerabilities in a Single Month

To put this month’s release into perspective: Microsoft patched 570 flaws in July 2026 and 400 in August 2026. September’s 966-vulnerability release shatters the company’s previous monthly record and represents one of the most intensive single-day patching events in enterprise IT history.

The breakdown by type tells its own story:

Vulnerability Class	Count
Elevation of Privilege	438
Remote Code Execution	258
Information Disclosure	173
Denial of Service	56
Security Feature Bypass	19
Spoofing	16

Products affected span the entire Microsoft stack: Windows 10/11 and Server 2019/2022/2025, Microsoft Office (Word, Excel, Outlook, OneNote), Exchange Server, SQL Server, SharePoint, Entra ID, and more than a dozen Azure services. No corner of a typical enterprise Windows estate escapes this month’s update scope.

The Two Actively Exploited Zero-Days Dissected

The most urgent items in this release are the two flaws confirmed as actively exploited in the wild before Microsoft shipped a fix. Security teams should treat these as P0 — patch within 24 hours, no exceptions.

CVE-2026-81963 — Windows Update Stack Privilege Escalation

This flaw resides in the Windows Update Stack — the core components responsible for downloading and installing Windows updates. At its technical heart, the bug is an improper link resolution before file access vulnerability (a classic “link following” class of bug).

• Attack type: Local Elevation of Privilege
• Prerequisite: A low-privileged, authenticated user on the target machine
• Impact: Full escalation to SYSTEM — the highest Windows privilege level, equivalent to root on Linux
• Discovered by: Romain Deperne and Microsoft’s own Threat Intelligence Centre, indicating the vulnerability was spotted during active incident response
• Zero-day status: Publicly disclosed and exploited before a patch existed

In practice, an attacker who has already established a foothold on a machine — via phishing, a malicious document, or a compromised application — can use CVE-2026-81963 to instantly gain kernel-level control, making it a critical second-stage exploit in multi-stage attack chains. This is exactly how ransomware gangs and APT groups operate in Indian enterprise environments today.

CVE-2026-85880 — Windows ALPC Heap Buffer Overflow

The second zero-day targets Windows Advanced Local Procedure Call (ALPC), the high-performance IPC mechanism that underpins inter-process communication across nearly every Windows service and application.

• Attack type: Local Elevation of Privilege (Heap Buffer Overflow)
• Prerequisite: Authenticated local user access
• Impact: Privilege escalation to SYSTEM
• Discovered by: Researchers at Volexity and Proofpoint (Mark Kelly, David Galazin, Jeremy Hedges) — two of the most respected threat-intelligence firms globally — again suggesting discovery during active attack campaigns

The ALPC subsystem is deeply embedded in Windows, meaning this flaw is exploitable on virtually every supported Windows version. Combined with a remote code execution vulnerability — of which there are 258 in this release alone — CVE-2026-85880 gives attackers a reliable, one-two punch: land on a machine remotely, then escalate immediately to SYSTEM.

For organisations already dealing with unpatched Exchange Server vulnerabilities or endpoint gaps left by delayed Windows updates, these two zero-days represent an existential threat to privilege boundaries across the entire domain.

The AI Effect: Why Microsoft’s Patch Counts Are Exploding

Microsoft has explicitly attributed this month’s extraordinary CVE volume to an AI-powered vulnerability discovery system it rolled out in early 2026. The system uses large language models and automated fuzzing to probe Microsoft’s own codebases at scale — identifying subtle logic errors, race conditions, and memory-safety bugs that traditional manual audits miss.

The result is a paradox for defenders: the same AI revolution that is accelerating attacker capabilities is also accelerating vendor self-discovery. More CVEs per month is actually a sign of improved internal security research — but the operational burden it places on enterprise patch teams is immense. A 966-CVE month requires triage, testing, and deployment at a pace that most IT organisations simply have not staffed for.

This is a structural shift. Expect patch volumes to remain elevated throughout 2026 and beyond as AI-assisted code auditing becomes standard across the industry. Organisations that are not running automated patch management will fall further and further behind.

Notable Critical RCE Vulnerabilities Beyond the Zero-Days

While the two zero-days demand immediate attention, several Critical-rated RCE flaws in this release are also high-priority for enterprise environments:

• CVE-2026-72986 & CVE-2026-73018 — Critical RCE in Graphic Fonts processing (affects Office, Windows): opening a malicious document or visiting a crafted webpage could execute attacker code with user privileges
• CVE-2026-72981 — Critical RCE in IP Helper: exploitable without user interaction on systems with specific IPv6 configurations enabled
• CVE-2026-78439 — Critical RCE in Microsoft Office Graphics: a crafted Office file triggers code execution; high risk in phishing campaigns targeting Indian enterprises
• CVE-2026-81955 — Critical RCE in Windows Graphics component: affects all supported Windows versions

Security teams with prior experience patching Windows RCE chains will recognise this pattern: graphics parsing, IPC, and Office document rendering are perennially attractive attack surfaces because they are universally exposed and deeply integrated into daily workflows.

What You Should Do Right Now — Sanjay Seth’s Defence Playbook

After 30 years in enterprise security and hundreds of incident responses across Indian organisations, here is the prioritised action plan I recommend for this month’s Patch Tuesday:

1. Patch the zero-days within 24 hours — no excuses.
   CVE-2026-81963 and CVE-2026-85880 are confirmed in-the-wild. Deploy the Windows security updates via WSUS, SCCM, Intune, or your preferred endpoint management platform today. Do not wait for your standard monthly maintenance window.
2. Prioritise servers before workstations.
   Domain controllers, Exchange Servers, SQL Servers, and Remote Desktop Gateway hosts are the crown jewels. An attacker with SYSTEM on a DC owns your entire Active Directory forest. Patch these first.
3. Enable Windows Defender Credential Guard and LSA Protection.
   EoP exploits are only dangerous if an attacker already has a foothold. Tighten your credential protection so that even a compromised session cannot dump password hashes or NTLM tokens for lateral movement.
4. Deploy application allow-listing on critical servers.
   If only known-good executables can run, the post-exploitation toolkit an attacker would need for CVE-2026-81963 or CVE-2026-85880 cannot execute — even if the patch is delayed by testing requirements.
5. Review your patch compliance dashboard right now.
   If you cannot answer “what percentage of our endpoints are patched within 48 hours of a Microsoft security release?”, that gap is itself a vulnerability. Automate and measure.
6. Hunt for signs of prior compromise.
   Given that both zero-days were exploited in the wild before patching, run a threat hunt for anomalous SYSTEM-level process creation, unexpected LSASS access, and new scheduled tasks or services created in the past 30 days.
7. Apply a Zero Trust lens to your patch workflow.
   Zero Trust is not just about network segmentation — it is about assuming breach. Treat every unpatched endpoint as potentially compromised, and enforce least-privilege access until patches are confirmed applied.

Sources for this analysis: BleepingComputer, SecurityWeek, CyberSecurityNews, and Action1 Patch Tuesday Analysis.

Frequently Asked Questions

Do both zero-days require physical access to exploit?

No — but they do require local authenticated access, meaning an attacker who already has a standard user account on the machine (via phishing, credential theft, or supply-chain compromise). They cannot be exploited remotely by an unauthenticated attacker on their own, but they are routinely chained with remote code execution exploits to achieve full system compromise from the internet. That is why patching the 258 RCE vulnerabilities in this release is equally critical.

Why did Microsoft rate these zero-days as “Important” rather than “Critical” despite active exploitation?

Microsoft’s severity ratings reflect standalone exploitability: because both CVEs require a local authenticated user — not a remote, unauthenticated attacker — they technically fall below “Critical” by MSRC’s rating methodology. In practice, however, active exploitation in the wild always overrides severity labels. Treat confirmed exploited vulnerabilities as Critical regardless of the official rating, and apply patches immediately.

What Windows versions are affected?

Both CVE-2026-81963 and CVE-2026-85880 affect all currently supported versions of Windows — Windows 10 (all supported editions), Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No supported Windows version is immune. End-of-life systems (Windows 7, Windows Server 2012) receive no patches and remain permanently exposed.

How does this month’s record patch count affect Indian enterprises specifically?

Indian enterprises — particularly in BFSI, IT/ITeS, manufacturing, and government — are heavily Windows-centric and frequently lag global patch cycles by two to four weeks due to change-management processes and bandwidth constraints at branch locations. 966 patches in a single release stretches testing and deployment pipelines to breaking point. This is a strong argument for adopting risk-based patch prioritisation: zero-days and Critical RCEs go immediately via emergency change; the remaining Important and Moderate patches follow the standard cycle.

---