Every second Tuesday of the month, Microsoft releases a batch of security fixes for Windows, Office, Azure, and its other products. This is routine, and most months it doesn't warrant much more than a quick "patch it" note from your IT team.
This month is different, and it's worth a few minutes of leadership attention, not just IT attention.
On September 8, 2026, Microsoft released fixes for over 970 vulnerabilities, the largest single Patch Tuesday release the company has ever issued. Of those, 113 are rated Critical, meaning they could allow an attacker to take meaningful control of a system with little or no help from a user. Two of the vulnerabilities were already being actively exploited by attackers before the fix was available.
In plain terms: this month's routine update is not routine, and the case for prioritizing it over other work this week is straightforward.
Why the number is so large
To put 970+ in context, the previous record for a single month was 570 vulnerabilities, set just two months earlier in July 2026. August's release, by comparison, covered around 400. September isn't a one-off spike so much as the continuation of a trend: Microsoft has been rolling out AI-assisted tools for finding security flaws in its own code, and that tooling is surfacing far more issues, far faster, than manual review ever did.
This is, on balance, good news. These are flaws being found and fixed by Microsoft before most of them are ever exploited, rather than flaws being found by attackers first. But it does mean the operational reality of "patch Tuesday" is changing. Nearly a thousand fixes in one release is a lot to review, test, and roll out, and organizations that treat every Patch Tuesday identically, without any sense of priority, are going to fall behind.
That's the real headline for leadership: the volume of these releases is growing, and patch management processes built around occasional, modest updates need to be re-evaluated for a world where a single month can bring almost a thousand fixes.
The two zero-days: patch these first
Out of the full list, two vulnerabilities matter more than the rest, because attackers were already using them before Microsoft's fix existed. Both allow what's called "elevation of privilege": an attacker who already has some limited foothold on a system, say, through a phishing email or a compromised account, uses the flaw to grant themselves full administrator-level (SYSTEM) control.
CVE-2026-81963, Windows Update Stack Elevation of Privilege. This flaw lives in the part of Windows responsible for installing updates. Microsoft's advisory describes it as an improper link-resolution issue that lets an attacker who already has some access on a machine escalate to full system control. It was reported by Microsoft's own threat intelligence team alongside an external researcher, which is often a sign that it was already being used in real attacks Microsoft was tracking.
CVE-2026-85880, Windows ALPC Elevation of Privilege. ALPC (Advanced Local Procedure Call) is a low-level Windows communication mechanism used constantly by the operating system and its services. A heap-based buffer overflow here lets an attacker with some access on a machine jump to SYSTEM privileges. This one was flagged by multiple independent research teams, another indicator that it was seeing real-world attention.
Neither of these is remotely exploitable on its own; an attacker needs some initial access first. But that's exactly the pattern behind most serious breaches: an attacker gets a foothold through phishing, a stolen credential, or an unrelated vulnerability, then uses a flaw like these two to go from "logged in as a regular user" to "full control of the machine." Patching these two should be treated as the top priority this month, ahead of the rest of the list.
What else is worth your attention
Beyond the zero-days, a handful of categories in this release deserve a closer look, without needing to walk through every individual CVE.
Remote code execution flaws in widely deployed server products. This release includes Critical-rated remote code execution issues touching Exchange Server, SQL Server, and other Microsoft server products that sit at the center of most corporate networks. Remote code execution means an attacker doesn't need existing access at all; a successful exploit lets them run their own code on the server directly. If your organization runs any on-premises Exchange, SQL Server, or SharePoint infrastructure, those systems should be near the top of your patching queue this cycle, right behind the two zero-days.
Graphics and font-rendering vulnerabilities. Several Critical remote code execution flaws this month sit in Windows' graphics and font-handling components. These are notable because exploitation often just requires a user to open or preview a malicious file, no clicking through a security warning required. They're a reminder that endpoint patching matters just as much as server patching.
A proof-of-concept targeting Microsoft Defender. Separately from the Patch Tuesday CVE list, researchers disclosed a new proof-of-concept exploit against Microsoft Defender, nicknamed ShieldCrash, around the same time as this release. It's worth having your security team confirm Defender is updated to the latest platform version, since an exploit against your endpoint protection tool undermines a lot of your other defenses at once.
Everything else. The bulk of the 970+ fixes fall into lower-priority categories: information disclosure bugs, denial-of-service issues, and elevation-of-privilege flaws that require an attacker to already be deeply embedded in your environment. These are worth patching in your normal cycle, but they don't demand the emergency treatment the items above do.
What should you do?
1. Prioritize, don't try to review everything at once
With nearly a thousand fixes in a single release, treating every CVE with equal urgency isn't realistic and isn't necessary. Focus first on the two actively exploited zero-days, then on Critical-rated remote code execution flaws in any internet-facing or business-critical systems (Exchange, SQL Server, SharePoint, and similar), then work through the rest on your normal patch cadence.
2. Apply the update through your normal patch management channel
For most organizations, this means Windows Update, WSUS, Intune, or whatever patch management tooling you already run. There is no special interim mitigation needed for the two zero-days; the fix is the September cumulative update itself.
# Check current Windows update status (PowerShell, run as administrator)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
3. Prioritize internet-facing and privileged systems
Domain controllers, Exchange servers, SQL Server instances, and anything reachable from the internet should be patched ahead of general workstations. If you run on-premises Exchange or SQL Server, confirm those specific fixes are included in your deployment before considering the cycle complete.
4. Confirm Microsoft Defender is current
Given the separate ShieldCrash proof-of-concept, verify Defender's platform and definition versions are up to date across your fleet, independent of the main Patch Tuesday rollout.
Get-MpComputerStatus | Select-Object AMProductVersion, AntispywareSignatureVersion
5. Test before broad deployment, but don't let testing become a delay
With a release this large, some regressions are statistically likely across a large fleet. A brief, targeted test on a representative subset of systems is reasonable. Given that two of these flaws are already being exploited, that testing window should be measured in hours or a couple of days, not weeks.
Summary
| Release date | September 8, 2026 |
| Total vulnerabilities addressed | Approximately 973 (largest Patch Tuesday on record) |
| Critical-rated vulnerabilities | Approximately 113 |
| Actively exploited zero-days | 2: CVE-2026-81963 (Windows Update Stack), CVE-2026-85880 (Windows ALPC) |
| Zero-day impact | Local elevation of privilege to SYSTEM; requires prior access |
| Highest-priority additional risk | Critical RCE flaws in Exchange Server, SQL Server, and graphics/font components |
| Related item (separate from Patch Tuesday) | ShieldCrash proof-of-concept targeting Microsoft Defender |
| Immediate action | Deploy the September cumulative update, prioritizing the two zero-days and any internet-facing or server infrastructure |
| Mitigation available? | No standalone workaround for the zero-days; the update itself is the fix |
A release of this size can feel overwhelming, but the practical guidance is simple: patch the two zero-days and your critical server infrastructure first, work through the rest on your normal schedule, and treat the growing size of these releases as a signal to revisit how your organization prioritizes patching going forward. If you need help triaging this release against your specific environment, testing the update safely, or building a more scalable patch prioritization process for months like this one, get in touch.