Microsoft ships its largest Patch Tuesday ever with 973 fixes and two exploited zero-days
Microsoft delivered 973 fixes on September 8, 2026 — the biggest Patch Tuesday in its history — including two elevation-of-privilege flaws already exploited in the wild. Deploy the two zero-days within 24 hours, then address the critical remote-code-execution flaws within seven days.
September 8, 2026. Microsoft ships its monthly Patch Tuesday. 973 vulnerabilities fixed — the largest single release the company has ever published. CVE-2026-81963 and CVE-2026-85880: two elevation-of-privilege flaws already being exploited in the wild. Why it matters: the volume is exploding under AI-assisted discovery, and the two most urgent flaws are rated “Important” rather than “Critical” — they would sink out of sight in any dashboard sorted by CVSS score.
A record volume that resets the baseline
The numbers describe an acceleration security teams are already calling the “Patch Apocalypse.” Microsoft fixed 621 flaws in July 2026 and 421 in August 2026. September jumps to 973 — nearly double the previous month and the largest month-over-month jump in Patch Tuesday history, with 113 of those rated critical.
The growth is not accidental. Todd Schell, a senior product manager at Ivanti, points to AI-assisted vulnerability discovery as the driver: the more fuzzers and code-review assistants run, the higher the monthly tally climbs. The operational consequence is blunt. A Windows estate that applied patches at a comfortable cadence now faces a growing monthly workload with no matching headcount increase.
Two exploited zero-days that hide in the “Important” tier
Two flaws are already exploited in the wild. CVE-2026-81963 rides through the Windows Update Stack to hand an authenticated attacker system-level privileges. CVE-2026-85880 chains through the Advanced Local Procedure Call (ALPC) component to the same end. Both are elevation-of-privilege bugs, both carry a CVSS of 7.8, and both land in the “Important” tier — not “Critical.”
That is exactly where defenders stumble. A dashboard sorted by CVSS score buries both flaws under dozens of patches that look more dramatic on paper. But exploitation status matters more than the score: a flaw already weaponized by attackers deserves an immediate response regardless of its rating. Microsoft recommends deploying KB5122871 and KB5122876 within 24 hours. CISA has added both to its KEV (Known Exploited Vulnerabilities) catalog — the administrative signal that triggers remediation obligations in most compliance frameworks.
The rest of the damage report
Behind the two zero-days the picture does not improve. Microsoft fixed a remote-code-execution flaw rated CVSS 10.0 — CVE-2026-70352 — which it describes as “more likely to be exploited.” The Windows DNS Server and Remote Desktop Services each absorb a 9.8 RCE flaw. Kerberos, the Deployment Services, and Schannel round out the high-severity list.
On the component front, the distribution shows the size of the surface. The Windows Biometric Service alone takes 64 fixes, ahead of SQL Server at 61 and Word at 38. Patches also land for Excel, NTFS, Win32K, and the XPS viewing stack. The cumulative nature of Windows updates softens the blow: a handful of KB packages covers most of it, rather than 973 separate actions.
Hotpatching: no-reboot patching goes general availability
September’s release carries a significant operational shift. Hotpatching reaches general availability for Windows Server Azure Edition virtual machines, meaning kernel patches apply without a reboot. For a team trying to absorb nearly a thousand fixes without waking administrators at 3 a.m., that is a measurable win — even if it remains limited to a specific Azure server edition for now.
The end-of-life calendar tightens in parallel. Windows 11 24H2 Home and Professional receive their final updates in October 2026. Windows Server 2012 and 2012 R2, along with Exchange 2016 and 2019, are approaching the end of their Extended Security Updates cycle. Estates that have not migrated yet are watching the window close.
A three-tier deployment strategy
Against this kind of volume, the order of application makes the difference. First tier — the two zero-days: CVE-2026-81963 and CVE-2026-85880, deployed within 24 hours without waiting for the next maintenance window. Second tier — critical RCE: CVE-2026-70352 and the 9.8 DNS and Remote Desktop Services flaws, addressed within seven days. Third tier — the remainder: the remaining “Important” and “Critical” fixes spread across Office, Exchange, SharePoint, and SQL Server over the rest of the month.
Two cautions apply. Edge Chromium vulnerabilities patch through the browser’s own update channel, not through Windows KB packages. And Microsoft has flagged known issues on several Exchange and SQL Server cumulative updates: test before pushing to production.
Verdict
September 2026 is not an isolated incident — it is the new normal. If your estate is up to date, your priority reduces to two identifiers: CVE-2026-81963 and CVE-2026-85880, deployed immediately because they are already exploited, not because their score is high. If your process sorts patches by CVSS, change it: exploitation status and the KEV catalog must come first. If you are still on Windows Server 2012 or Exchange 2016, the patch will soon stop being enough — migration has become your most urgent security action this quarter.
References
- NT Compatible — Microsoft September 2026 Patch Tuesday: 973 CVEs Fixed, 2 Actively Exploited Flaws Confirmed
- Ivanti — September 2026 Patch Tuesday
- CrowdStrike — September 2026 Patch Tuesday: Updates and Analysis
- Microsoft — September 2026 Security Update Guide
- ETTAYEB — CVE-2026-81963
- ETTAYEB — CVE-2026-85880