Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days

Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities across its software ecosystem, including two actively exploited Windows zero-day flaws. CVE-2026-85880 is a heap-based buffer overflow in Windows ALPC that enables local privilege escalation to SYSTEM privileges. CVE-2026-81963 is an improper link resolution vulnerability in the Windows Update Stack, also allowing local privilege escalation. Both vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by September 22, 2026.

AI-extracted · verify before operational use