Patch Tuesday Sets a Record,
Microsoft Fixes 974 Flaws
Microsoft’s biggest single patch release ever includes two Windows zero-days already under attack and 20 bugs security researchers call wormable.
This month’s Patch Tuesday broke Microsoft’s own record, and not by a small margin. On September 8, Microsoft shipped fixes for 974 vulnerabilities in a single release, according to the company’s own count — other researchers tracking the same release put the number anywhere from 964 to 972, depending on how revised and multi-product advisories get counted. Either way, it comfortably beats July’s previous record of 570.
Buried inside that number are two vulnerabilities Microsoft confirms are already being exploited in real attacks: a sandbox-escape bug in Windows ALPC and the first-ever exploited flaw in the Windows Update Stack. Both just landed on CISA’s Known Exploited Vulnerabilities list, which means federal agencies now have a hard deadline to patch them.
This piece breaks down where all 974 fixes actually went, what the two active zero-days do, why security researchers are flagging 20 more bugs as “wormable,” and what to prioritize if you’re the one pushing these updates out.
What This Patch Tuesday Fixed
974 vulnerabilities across Windows, Office, SQL Server, SharePoint, Exchange, and developer tools in a single release.
Already Under Attack
Two zero-days — one in Windows ALPC, one in the Windows Update Stack — are being actively exploited right now.
Why This Patch Tuesday Jumped
Microsoft points to AI-assisted code auditing finding far more issues than manual review caught in past years.
Federal Patch Deadline
CISA added both zero-days to its Known Exploited Vulnerabilities catalog, giving federal agencies until September 22 to patch.
The New Record: 974 CVEs in One Patch Tuesday
ScaleElevation-of-privilege bugs made up nearly half of everything patched, followed by remote code execution flaws. Word alone picked up 38 fixes and Excel 32, several of them critical RCE bugs triggerable just by opening a malicious document. Zero Day Initiative’s Dustin Childs flagged 20 of the newly resolved vulnerabilities as wormable, meaning they allow remote code execution without authentication or any user interaction at all.
Zero-Day #1: A Windows ALPC Sandbox Escape
CVE-2026-85880This heap buffer overflow in Windows Advanced Local Procedure Call lets a local attacker who’s already running low-privilege code escape an AppContainer sandbox and gain SYSTEM-level access, with no additional user interaction required. Microsoft hasn’t patched an ALPC flaw since April 2023, and researchers note this is only the second ALPC zero-day the company has fixed since CVE-2023-21674 in January 2023.
Zero-Day #2: The Update Stack’s First Exploited Bug
CVE-2026-81963This is a link-following flaw in the Windows Update Stack — the very component responsible for installing updates — that lets an attacker manipulate how the system resolves file paths to elevate privileges. Tenable counts seven privilege-escalation flaws in the Update Stack since 2022, but this is the first one confirmed as a zero-day and the first exploited in the wild.
20 Wormable Bugs Nobody’s Talking About Enough
Beyond Zero-DaysThe two confirmed zero-days are getting the headlines, but security teams are also flagging a longer list of critical fixes worth prioritizing: CVE-2026-69730 (Windows DNS Server RCE, CVSS 9.8), CVE-2026-69525 (Remote Desktop Services RCE), CVE-2026-55007 (Exchange Server RCE), CVE-2026-69465 (SharePoint RCE), and CVE-2026-69676 (Kerberos RCE, CVSS 8.8) among them.
More bugs found doesn’t mean
more bugs exploited, yet.
- Patch CVE-2026-85880 and CVE-2026-81963 first — both are confirmed exploited and on CISA’s KEV list with a September 22 federal deadline.
- Prioritize the 20 wormable bugs next, especially unauthenticated RCE flaws in DNS Server, RDS, and Exchange.
- Test Office macro-triggered RCE fixes for Word and Excel before wide rollout, since these can be triggered just by opening a file.
- Don’t skip Servicing Stack Updates if you’re running Windows Server 2012, 2012 R2, or Windows 10 1607/Server 2016.
- Budget extra time this cycle — a record-sized patch batch means more compatibility testing before full deployment.
⚠️ Why This Patch Tuesday’s 2 Zero-Days Undersell the Risk
1. The exploited count is what’s confirmed, not what’s possible. Microsoft rates 58 fixes this month as “more likely to be exploited” — the two confirmed zero-days may not stay the only ones targeted for long.
2. Wormable bugs scale fast. Unauthenticated RCE flaws that need zero user interaction are historically the ones that turn into automated, self-spreading attacks once technical details circulate.
3. A record patch count means a record testing burden. Security teams already struggling to triage monthly updates now face nearly double last year’s typical volume, which can itself delay how quickly critical fixes actually get deployed.