Microsoft's September 2026 Patch Tuesday, released on 8 September, is the largest monthly security update in the company's history — and two of the flaws it fixes were already being exploited before the patch shipped. If your business runs any Windows server or workstation, this is not a release to leave in the "get to it this month" pile.
How big, and why the count depends who you ask
The headline CVE count varies by source: the Zero Day Initiative logged 972 new CVEs, Microsoft's own release notes tally 974, BleepingComputer counted 966, and Tenable puts the figure at 964. The gap comes down to how each organisation counts advisories that touch multiple products, or that get revised after first publication — not a real disagreement about what shipped. Every count agrees on the thing that matters: this is Microsoft's largest patch release on record, by a wide margin.
Of those flaws, 105 are rated Critical, 81 of them remote-code-execution bugs. Twenty are rated wormable — capable of spreading between machines without user interaction — including a DNS Server remote-code-execution flaw, CVE-2026-69730, that researchers describe as a spiritual successor to SigRed, the 2020 DNS Server bug that forced emergency patching across the industry.
The two zero-days actually under attack
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the interprocess-communication mechanism that underpins RPC, COM and a broad set of system services on every supported version of Windows. An attacker who already has low-privilege code execution — even sandboxed inside an AppContainer — can use this flaw to escape the sandbox and reach SYSTEM privileges. It is the first ALPC vulnerability in a Patch Tuesday release in more than three years.
CVE-2026-81963 is an elevation-of-privilege flaw in the Windows Update Stack, caused by improper link resolution before file access, which lets an already-authenticated local attacker escalate to higher privileges.
Both were confirmed as actively exploited by Microsoft and added to CISA's Known Exploited Vulnerabilities catalogue on 8 September — the same day the patches shipped. Neither requires an unauthenticated remote attacker on its own, but both are real building blocks in a longer attack chain: get in through some other route, then use one of these to reach SYSTEM.
What to actually do this week
Patch the two zero-days first if you cannot patch everything at once. Both are confirmed exploited today, not theoretically exploitable — that puts them ahead of anything rated only Critical-but-unexploited in your prioritisation.
Do not skip the wormable bugs because none is a zero-day yet. CVE-2026-69730 and the other nineteen wormable flaws have the potential to become next month's incident if they go unpatched across a fleet — SigRed's lineage is exactly this kind of bug: quiet for a while, then very not quiet.
If you run Windows Server, prioritise it over workstations if you have to choose. ALPC and the Update Stack are present on every edition, but a compromised server generally has a larger blast radius than a compromised laptop.
Small teams without a dedicated patch cadence should turn on automatic updates for servers, not just endpoints. This is the release where "we'll patch servers manually next maintenance window" is a genuinely risky sentence, given two components were under active attack the same day the fix became available.
Why this is not just a Microsoft problem
This lands one day after Adobe's out-of-band fix for the CVSS 10.0 Magento/Adobe Commerce zero-day, and in the same week as Android's own 180-flaw security update. None of these are related incidents, but the pattern across September is consistent: several platforms a typical SaaS stack depends on shipped emergency or record-sized fixes within days of each other. If your patch process assumes vendors ship on a predictable, low-volume monthly cadence, this month is the one that breaks that assumption.
The bottom line
September's Patch Tuesday fixed somewhere between 964 and 974 flaws depending on how you count — Microsoft's largest release ever — and two of them, CVE-2026-85880 and CVE-2026-81963, were already under active attack the day the fix shipped. Patch those two first, do not deprioritise the twenty wormable bugs because none is a zero-day yet, and treat "vendors patch predictably" as an assumption this particular week disproved.