Microsoft's September 2026 Patch Tuesday update is the largest ever, surpassing the record of 966 vulnerabilities. Of these, 105 were rated critical and two zero-days that are already being used in attacks.
The new Patch Tuesday updates address 105 “Critical” vulnerabilities, 81 of which involve remote code execution, 20 elevation of privilege, 2 information disclosure, and 1 security feature bypass.
The approximate number of bugs in each vulnerability category is below:
– 438 Elevation of Privilege Vulnerabilities
– 19 Security Feature Bypass Vulnerabilities
– 258 Remote Code Execution Vulnerabilities
– 173 Information Disclosure Vulnerabilities
– 56 Denial of Service Vulnerabilities
– 16 Spoofing Vulnerabilities
Last month, updates released through Microsoft's Patch Tuesday fixed 570 security vulnerabilities.
This month's Patch Tuesday update also fixed two zero-days already being used by malicious users.
The zero-days that have been actively exploited and addressed during this September 2026 Patch Tuesday update are:
CVE-2026-81963 – Elevation of Privilege Vulnerability in Windows Update Stack
Microsoft has fixed an actively exploited elevation of privilege vulnerability in the Windows Update Stack that could allow attackers to gain SYSTEM privileges.
"Improper connection analysis before accessing files in the Windows Update Stack allows a privileged attacker to elevate privileges locally," Microsoft warns.
The vulnerability was discovered by Romain Deperne and the Microsoft Threat Intelligence Centre (MSTIC).
CVE-2026-85880 – Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Microsoft has fixed a flaw in Windows' Advanced Local Procedure Call (ALPC) that was being exploited in attacks to gain SYSTEM privileges.
"Heap-based buffer overflow in Windows ALPC allows a privileged attacker to elevate privileges locally," Microsoft explains.
The bug was discovered by Volexity and Mark Kelly, David Galazin, Jeremy Hedges with Proofpoint.
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
