Microsoft patches a record 964 CVEs in September, including two already-exploited zero-days
The September 8, 2026 Patch Tuesday breaks a record with 964 CVEs, including two zero-days already exploited in the wild, CVE-2026-81963 and CVE-2026-85880. Triage the bulletin by exploitability — zero-days first, then internet-facing RCEs — rather than by raw score.
September 8, 2026. Microsoft shipped the largest Patch Tuesday in its history: 964 fixed CVEs, including 104 critical and 860 important. Two of them are already exploited in the wild as zero-days: CVE-2026-81963 in the Windows Update Stack, and CVE-2026-85880 in Windows ALPC. Why it matters: a record volume is not something you “process”; it is something you triage — and the triage that matters is not by score but by exploitability.
Two exploited zero-days, and what they say
The two flaws already being used by attackers share one telling trait: they are local privilege escalations, not entry points.
CVE-2026-81963 affects Windows Update Stack, with a CVSS 7.8. It is a link following flaw that escalates to SYSTEM. Since 2022, seven flaws in this component had been fixed, but CVE-2026-81963 is the first exploited in the wild as a zero-day.
CVE-2026-85880 affects ALPC (Advanced Local Procedure Call), also at CVSS 7.8, and likewise reaches SYSTEM. It is the first ALPC flaw to enter a Patch Tuesday since April 2023, and the second exploited as a zero-day since CVE-2023-21674.
The pair has a strategic reading. A local EoP is step two of an attack chain: the attacker has already obtained limited access — via phishing, an application RCE, or stolen credentials — and the zero-day turns that access into full control of the machine. Patching these two does not protect against entry; it closes the escape hatch the attacker uses to persist and move laterally.
A record volume hides the real problem: triage
964 CVEs is more than double August’s bulletin, and July’s previous record falls. The impact breakdown tells a finer story: 44.7% of the flaws are privilege escalations (EoP), and 26.8% are remote code executions (RCE).
The raw figure of 964 is misleading for a busy CISO. Nobody fixes 964 flaws in a week, and trying to do so blindly spreads effort over components nobody exposes. The real work of the day is not to patch “everything” — it is to build an order that puts patching effort where exploitation is already real or likely.
The recommended triage is three tiers, and the first two deserve a full working day.
Internet-facing RCEs come before the rest
After the two zero-days, the second tier is the network-reachable RCEs, because those become entry points. Three families stand out:
- CVE-2026-69525 — an RCE in Remote Desktop Services, scored CVSS 9.8, caused by a use-after-free and rated “exploitation more likely” by Microsoft. Three more RDS RCEs (7.5 each) accompany it.
- CVE-2026-69676 — an RCE in Windows Kerberos, scored CVSS 8.8, via capture-replay authentication bypass, also “exploitation more likely”.
- Nine RCEs in Windows DNS Server, including CVE-2026-69730 at CVSS 9.8. That family deserves separate treatment — we break it down in the dedicated network article.
There is also CVE-2026-69380, an EoP in Exchange Server scored CVSS 8.1, which lets a low-privilege authenticated user reach other accounts’ mailboxes — less urgent while unconfirmed, but worth watching on exposed Exchange servers.
What to put in place
Work the bulletin in three passes, in this order:
- Pass one — the two zero-days. Apply the fix for CVE-2026-81963 and CVE-2026-85880 on every endpoint and server, without waiting for the monthly window. These are the only flaws with confirmed exploitation, and they turn any initial access into SYSTEM control.
- Pass two — the network RCEs. Prioritize CVE-2026-69525 (RDS), CVE-2026-69676 (Kerberos), and the nine DNS RCEs, in order of each service’s actual exposure. An RDS open to the internet outranks an already-segmented internal DNS server.
- Pass three — the long tail. The remaining EoPs and application fixes join the usual monthly rhythm, starting with the components your vulnerability scanner already reports as reachable.
Add one simple check: verify that the count of machines still unpatched on the two zero-days drops to zero by the end of the week. For a bulletin this size, that is the only metric that matters.
Verdict
If your estate is largely Windows and you run a monthly patch cadence, September demands an exception: pull the two zero-days out of the normal flow and treat them as a high-severity incident, because their exploitation is already documented. If you expose Microsoft services to the internet — RDS, DNS, Kerberos — move the network RCEs into pass two immediately, ahead of everything else in the bulletin. If your estate is small and current, the main risk is not volume but omission: an inventory that does not separate exposed machines from internal ones will burn the day on the wrong flaws.