Microsoft’s September Patch Tuesday zero-days are the headline concern in a colossal monthly update that addresses 966 flaws, including two vulnerabilities that were already being actively exploited in the wild before the fixes landed. It is the kind of number that makes you want to run Windows Update right now, if you have not already.
The sheer scale of this month’s release is largely attributed to AI, which is making it easier for attackers to develop exploitation tools while simultaneously allowing developers to find and patch flaws faster. The net effect: bigger updates, arriving more often.
What the September Patch Tuesday zero-days actually do
Both zero-days are elevation-of-privilege vulnerabilities, meaning they let an attacker escalate their access on a compromised machine. CVE-2026-81963 is a flaw in the Windows Update Stack. It allows attackers to gain SYSTEM privileges through improper link resolution before file access. The bug was discovered by Romain Deperne and the Microsoft Threat Intelligence Centre.
The second zero-day, CVE-2026-85880, is a flaw in the Windows Advanced Local Procedure Call (ALPC) mechanism. According to SOCPrime, it is specifically a heap-based buffer overflow vulnerability. An attacker could execute code within a low-privilege AppContainer and then escape that sandbox to gain SYSTEM privileges locally. The bug was found by Volexity, and by Mark Kelly, David Galazin, and Jeremy Hedges at Proofpoint.
Both have been actively exploited in the wild. Microsoft has not provided details on how they were used in attacks.
SOCPrime’s analysis notes that both CVE-2026-85880 and CVE-2026-81963 carry a CVSS score of 7.8, placing them in the high-severity band. A 7.8 does not quite reach the critical threshold, but given that both have been weaponised already, the severity score is somewhat academic at this point.
The full scale of this month’s update
The 966 flaws fixed this month are spread across six categories, as BleepingComputer reports: 438 elevation-of-privilege vulnerabilities, 258 remote-code-execution vulnerabilities, 173 information disclosure vulnerabilities, 56 denial-of-service vulnerabilities, 19 security feature bypass vulnerabilities, and 16 spoofing vulnerabilities.
Those figures do not include a further 204 vulnerabilities patched earlier in the month across other Microsoft products. BleepingComputer also reports that 105 of this month’s vulnerabilities are rated “Critical”, with 81 of those Critical flaws being remote code execution vulnerabilities. Remote code execution is the category that tends to keep security teams up at night: an attacker can run arbitrary code on a target machine without needing physical access.
The jump in overall patch volume is consistent with a broader industry pattern. AI tools are lowering the barrier for both sides of the security equation. Threat actors can use them to probe for and develop exploits more quickly; defenders can use them to audit and patch codebases faster. The result is a faster treadmill, not necessarily a safer one, at least not yet.
How to make sure you are covered
Microsoft typically releases Patch Tuesday fixes at around 10am PT on the second Tuesday of every month. Most Windows PCs will receive these updates automatically, but it is worth checking manually, particularly given the two actively exploited zero-days in this cycle. Go to Start, then Settings, then Windows Update, and select Check for Windows updates.
Installing security updates promptly has always mattered. With two SYSTEM-privilege exploits already in the wild, this month it matters rather more than usual.
