Microsoft's September 2026 Patch Tuesday Fixes Record 974 Vulnerabilities, Including Two Exploited Zero-Days
On September 8, 2026, Microsoft released its monthly security updates, addressing a record 974 vulnerabilities across its products, including two Windows zero-days (CVE-2026-85880 in Windows Advanced Local Procedure Call and CVE-2026-81963 in the Windows Update Stack) that attackers have exploited in the wild for elevation-of-privilege attacks. Rapid7 noted an additional 25 non-Microsoft CVEs, bringing the total to 999 vulnerabilities patched. Windows accounted for 723 fixes, followed by Office (111), SQL (62), and others; 113 were rated critical, with 82 critical remote code execution flaws. Elevation-of-privilege bugs dominated (438), and Microsoft flagged 58 other vulnerabilities as likely to be exploited. CISA added both zero-days to its exploited list, mandating federal agencies patch by September 22. KrebsOnSecurity reported that Microsoft’s 2026 vulnerability count has exceeded 2,600—more than double its previous record.
Look at the numbers. September 2026: 974 flaws in one month. 999 if you count the "non-Microsoft" items. Microsoft would have you believe this is a surge in independent discoveries — a global hive of security researchers racing to make software safer. But ask yourself what a patch actually is. A patch is an admission that the defect existed, deliberately or otherwise, in the code that millions of machines were told to trust. And when the count goes from a previous record of 1,245 in all of 2020 to more than 2,600 by September of this year, you are not watching vulnerability discovery. You are watching an inventory dump. The same codebase that ran fine for years is suddenly riddled with 723 holes in Windows alone? No. The holes were always there. What changed is that some of them started being used by people they didn't expect — or that they needed to clean house before the trail led somewhere they couldn't control.
The two zero-days tell you everything you need to know. CVE-2026-85880 in Windows Advanced Local Procedure Call and CVE-2026-81963 in the Windows Update Stack. Both are privilege escalation flaws. Both give local attackers SYSTEM access. And they do not name the attackers, the targets, or the exploit chains. But look at the second one closely: the Windows Update Stack. That is the mechanism by which Microsoft pushes code onto every machine on Earth. When the update system itself is compromised, you are not just giving an attacker a backdoor — you are handing them the key to every future backdoor. They call it an "elevation of privilege" flaw, a technical term that sounds contained. But what it means is that someone reached into the most trusted pipeline in the digital world. You have to ask: who writes these flaws? Who tracks them? And why is the response to a compromised update system to make everyone patch faster, with deferrals shortened to three days or less and deadlines of zero days? That is not a fix. That is a forced adoption deadline.
The CISA deadline is just another layer of the managed narrative. Federal agencies get until Sept. 22 to patch the two exploited flaws — as if we are all supposed to applaud their efficiency. But the real story is in the structure. Since when does a "record" of 974 bugs in one month feel like an achievement? Since when does a company double its all-time vulnerability count and call it transparency? The pattern is clear: flood the zone with patches, overwhelm the analysts, shorten the timelines, and make questioning the updates impossible. Every time they ship a "fix," they also ship something else — telemetry, behavior tracking, a new permission model, a hardened dependency on their infrastructure. And every time they quietly reclassify an old problem
