Microsoft Patches 964 Flaws, Two Zero-Days Exploited in Wild

Executive Summary

Microsoft's September 2026 Patch Tuesday release addresses a record 964 vulnerabilities, including two Windows elevation-of-privilege (EoP) zero-days that were actively exploited before patches were available. The two exploited flaws—CVE-2026-81963 and CVE-2026-85880—both carry a CVSS score of 7.8 and allow local attackers to gain SYSTEM privileges, a critical step in post-exploitation chains. With 104 Critical and 860 Important rated flaws, this release is the largest in Microsoft's history, and defenders should prioritize the exploited zero-days and the high-severity remote-code-execution (RCE) flaws in Windows DNS Server and Remote Desktop Services.

Technical Analysis

Microsoft's full September security release lists 974 CVEs, but 10 of those affect cloud services or are fixes Microsoft applies automatically, leaving 964 vulnerabilities that customers must patch themselves. The breakdown includes 723 flaws in Windows, 111 in Office and Office 2016, 62 in SQL, and 22 in Developer Tools, according to The Hacker News. Over 110 of these are rated Critical.

The two zero-days are both local EoP vulnerabilities, meaning they do not provide remote access on their own. However, they are valuable to attackers who have already gained a foothold via phishing or credential theft, as SYSTEM-level access enables disabling defenses, accessing protected data, establishing persistence, and moving laterally.

CVE-2026-81963 is an improper link resolution before file access ('link following') vulnerability in the Windows Update Stack. Microsoft's description notes that an authorized attacker can exploit this to elevate privileges locally. The flaw allows Windows to be tricked into opening or modifying the wrong file because it follows a shortcut-like pointer without verifying where it leads. Microsoft confirms attackers exploited this bug before a patch was available.

CVE-2026-85880 is a heap-based buffer overflow in Windows ALPC (Advanced Local Procedure Call), an internal messaging system that allows processes to communicate. Microsoft states that an attacker who can execute code in a low-privilege AppContainer can exploit this locally to escape the sandbox and elevate privileges, with no user interaction required. Heap-based buffer overflows occur when data written to a memory region exceeds its boundary and spills into adjacent memory, potentially allowing an attacker to control execution flow.

The release also includes high-severity RCE vulnerabilities in Windows DNS Server and Remote Desktop Services, as well as fixes for Exchange Server, SharePoint, SQL Server, Office, and core Windows components. While specific CVE IDs for these RCEs were not detailed in the sources, their presence in a Patch Tuesday release of this size underscores the need for comprehensive patch management.

Mitigations & Recommendations

Given the active exploitation of CVE-2026-81963 and CVE-2026-85880, Microsoft recommends applying the September 2026 updates immediately. To install patches on Windows: open Settings, select Windows Update, and click 'Check for updates.' If updates are available, they will download automatically; restart when prompted and verify the system shows 'You're up to date.'

Defenders should prioritize the two zero-days and the RCEs in Windows DNS Server and Remote Desktop Services, as these are likely to be weaponized quickly. For organizations with restricted patch windows, focus on internet-facing systems and those running Active Directory or RDS. Monitor for unusual privilege escalation activity, such as unexpected SYSTEM-level processes or ALPC-related anomalies, as indicators of exploitation attempts.