Microsoft Just Shipped 964 Patches in One Day. Two of Them Are Already Being Used Against Machines Like Yours.
September 2026's Patch Tuesday is the largest on record — 964 CVEs, 104 critical, and two zero-days already exploited to grab SYSTEM-level control. Here's what actually needs to happen on the Windows box running your POS or back office this week, and what can wait.
Note: Microsoft shipped this on September 8, 2026 — three days old as of writing. CISA added both actively-exploited flaws to its Known Exploited Vulnerabilities catalog the same day, with a September 22 remediation deadline for federal agencies. That deadline doesn’t apply to your shop directly, but it’s a useful signal for how urgent the people who track this for a living think it is.
Quick gut check: the Windows machine running your point-of-sale software, your back-office bookkeeping, or your admin dashboard — when did it last actually restart and apply updates, versus just sit there with a little shield icon nobody’s clicked in weeks? If you don’t know the answer, this is the Patch Tuesday to actually stop and check, not the one to file under “Microsoft does this every month, I’ll get to it.”
What just shipped, in plain numbers
Microsoft’s September 2026 Patch Tuesday is the largest single release in the program’s history: 964 unique CVEs patched in one batch, including 104 rated Critical. For comparison, a typical Patch Tuesday runs somewhere in the 60–130 CVE range — this one is roughly seven to fifteen times a normal month’s volume, all landing on the same day, all needing the same decision from whoever manages your machines: apply now, or push it off.
| Category | Count |
|---|---|
| Total CVEs patched | 964 |
| Rated Critical | 104 |
| Critical remote code execution (RCE) | 81 |
| Critical elevation of privilege | 20 |
| Actively exploited zero-days | 2 |
| Windows-specific CVEs | 723 |
| Office suite CVEs | 222 |
| SQL Server CVEs | 62 |
| SharePoint Server CVEs | 16 |
| Exchange Server CVEs | 9 |
The Windows number — 723 of the 964 — is the one that matters most for a small shop, because Windows is the operating system underneath most POS terminals, back-office desktops, and admin machines that never made it onto anyone’s “enterprise IT” radar because there isn’t an IT department. Office’s 222 matters almost as much, because Word, Excel, and Outlook are the three programs most likely to be open, unattended, on a machine that also has a browser tab logged into your bank or payment processor.
This didn’t beat the old record by a small margin — it crushed it. The previous high-water mark was July 2026’s release, at 569 CVEs. September’s 964 is nearly 70% larger than the release that, two months earlier, was itself being written up as unusually large. Some of that jump has a specific, traceable cause rather than being pure coincidence: Microsoft has said it began using AI-assisted tooling to find vulnerabilities in its own codebase starting around the middle of 2026, and the volume of disclosed CVEs has trended up noticeably since — which is a genuinely double-edged development for a small shop. More flaws found by Microsoft’s own tooling before anyone else finds them is, on balance, good news; it also means “record-setting Patch Tuesday” is likely to keep being the norm rather than a one-off headline, and a patching routine built around “check in when something looks unusually big” stops working once unusually big is just what a normal month looks like.
The two that are already being used against real machines
Out of 964 patched flaws, two are confirmed under active exploitation right now — meaning attackers already have working code for these, not theoretical proof-of-concepts sitting in a research paper.
CVE-2026-81963 — an elevation-of-privilege flaw in the Windows Update Stack itself. It’s a “link following” bug: improper resolution of a file link before the system acts on it, which an attacker with initial local access on a machine can exploit to jump from a limited foothold to full SYSTEM-level control. This is notable beyond the immediate risk because it’s the first time a Windows Update Stack elevation bug has been caught being exploited as a zero-day — the mechanism Windows uses to patch itself was, itself, the door in.
CVE-2026-85880 — an elevation-of-privilege flaw in Windows Advanced Local Procedure Call (ALPC), a low-level internal messaging system Windows components use to talk to each other. The bug combines a heap-based buffer overflow with use of an uninitialized resource — technical details that matter less than the outcome: successful exploitation, like the flaw above, hands an attacker SYSTEM privileges. More specifically, the flaw lets an attacker who’s already running code inside a low-privilege AppContainer — the sandbox Windows uses to isolate things like browser tabs and modern apps from the rest of the system — escape that sandbox entirely and elevate straight to SYSTEM. That’s a meaningful detail for a small shop: sandboxing (in a browser, in a modern Windows app) is exactly the kind of protection people assume is holding even when something sketchy gets opened, and this bug is a documented way around it.
Both flaws were confirmed exploited before patches became available — not discovered after the fact through forensic cleanup, but caught being actively used in the wild while still unpatched, which is what earned them zero-day status and same-day placement in CISA’s Known Exploited Vulnerabilities catalog. Both also require no user interaction and low attack complexity once an attacker has that initial foothold, which is part of why CISA gave federal agencies a two-week window instead of the usual longer remediation timeline. Credit for catching CVE-2026-85880 went to security firms Volexity and Proofpoint; CVE-2026-81963 was reported by Romain Deperne, an offensive security researcher at Airbus Helicopters, working alongside Microsoft’s own Threat Intelligence Center — a reminder that a meaningful share of the researchers finding these bugs before wider criminal use aren’t Microsoft employees at all.
| Detail | CVE-2026-81963 | CVE-2026-85880 |
|---|---|---|
| Component | Windows Update Stack | Windows ALPC |
| Type | Elevation of privilege (link following) | Elevation of privilege (heap overflow + uninitialized resource) |
| CVSS score | 7.8 | 7.8 |
| Outcome if exploited | SYSTEM-level control | SYSTEM-level control |
| First seen exploited as zero-day | Yes — first-ever Update Stack EoP zero-day | No prior public record found |
| Added to CISA KEV | September 8, 2026 | September 8, 2026 |
Both are “elevation of privilege” bugs, not remote-entry bugs on their own — meaning an attacker needs some existing foothold on the machine first (a phished credential, a malware dropper, a compromised browser extension) before either of these turns that foothold into full control. That’s a real distinction, not a reason to relax: elevation-of-privilege bugs are exactly the second stage of almost every real-world small-business breach, the step that turns “someone got a foothold” into “someone owns the machine.” A machine that’s otherwise reasonably careful — MFA on, browser patched, no obviously sketchy downloads — is still exposed to this pair if literally anything else on that machine gets compromised first.
The other three worth knowing about, even though nobody’s actively using them yet
Beyond the two confirmed zero-days, three other flaws in this batch stand out for small shops running any kind of networked Windows setup:
- CVE-2026-69730 (Windows DNS Server) — Critical, CVSS 9.8, unauthenticated remote code execution via a crafted network packet. Microsoft rates this “Exploitation More Likely.” Most small shops don’t run a dedicated DNS server, but if you’re running Windows Server anywhere in the back office for file sharing or a domain controller, this is the one to prioritize immediately.
- CVE-2026-69676 (Windows Kerberos) — Critical, CVSS 8.8, remote code execution through an authentication bypass. Also rated “Exploitation More Likely.”
- CVE-2026-69525 (Remote Desktop Services) — CVSS 9.8, a use-after-free RCE that’s reachable over the network if RDP is exposed to the internet. If anyone on your team uses Remote Desktop to access a back-office machine from home — a common small-shop setup — and that RDP port is forward-facing on your router rather than behind a VPN, this is directly relevant, not theoretical.
None of these three has a confirmed real-world exploit yet, which is why they’re not framed as urgently as the pair above. “Exploitation More Likely” is Microsoft’s own internal assessment that working exploit code is probable soon, based on how the flaw analyzes and how similar bugs have played out historically — it’s a forecast, not a confirmation, but it’s Microsoft’s own security team making that call, not outside speculation.
Why “just enable auto-update” doesn’t fully cover this
Windows generally does download and install updates automatically on default consumer and small-business configurations — so the honest question isn’t “does my machine update itself,” it’s “has it actually restarted since September 8, and is it running the patched build right now.” Three specific small-shop situations break the assumption that auto-update means you’re covered:
- Machines that stay running for weeks. Windows Update downloads patches in the background but most of them require a restart to actually apply. A back-office desktop or POS terminal that’s been left running continuously — a common choice, because closing it down feels risky when it’s the machine ringing up sales — can sit on a fully-downloaded but unapplied patch for a long time.
- Update policies set years ago and forgotten. Some small-business machines were configured once, by whoever set them up originally (an IT contractor, a relative, a previous employee), with update settings tuned for “don’t interrupt the register during business hours.” That’s a reasonable original intent that quietly turns into “updates never actually apply” if nobody revisits the schedule.
- Out-of-support or unusual Windows builds. A POS vendor’s software sometimes only certifies a specific Windows version, which can mean a machine deliberately frozen on an older build that either doesn’t receive this patch cycle at all or requires a manual, non-automatic update path.
The two-minute check: open Settings → Windows Update on every Windows machine that runs your business, and confirm it says “You’re up to date” with a build date on or after September 8, 2026 — not just that an update is “downloading” or “pending restart.” If it’s pending, restart it today rather than waiting for the next natural reboot, which for an always-on POS terminal might be months away.
A worked example: the four-machine shop, patch edition
Take the same small retail setup a lot of these pieces come back to: a POS terminal at the counter, a back-office desktop for books and supplier orders, a shared laptop for email and social media, and an owner’s personal laptop that occasionally handles business email remotely via RDP into the back-office machine.
Walking through it honestly: the POS terminal is managed by the POS vendor and likely patches on its own schedule — verify it anyway rather than assuming. The back-office desktop has been running for three weeks straight and shows “restart to finish updating” the moment you check. The shared laptop restarts nightly and is almost certainly current. The owner’s personal laptop uses RDP into the back office from home — which means CVE-2026-69525 is directly relevant if that RDP connection isn’t going through a VPN, and worth checking today rather than after reading the rest of this list.
| Machine | Real risk this cycle | Action |
|---|---|---|
| POS terminal | Vendor-managed, but verify | Confirm build date, don’t assume |
| Back-office desktop | Pending restart = unpatched | Restart today, don’t wait for next natural reboot |
| Shared laptop | Likely current (nightly restarts) | Spot-check build date |
| Remote RDP access | CVE-2026-69525 directly relevant if RDP is internet-facing without a VPN | Put RDP behind a VPN or disable direct exposure; patch immediately either way |
Total time for a genuine audit across four machines: about fifteen minutes, most of it just watching a progress bar. The actual failure mode isn’t technical difficulty — it’s the same one that shows up in every patching story: nobody owns the recurring check, so “up to date” quietly drifts into “up to date as of six weeks ago.”
Why the batch is this big, and why “record-setting” isn’t just a headline number
A 964-CVE month doesn’t mean Microsoft’s code got seven times worse overnight — it reflects a few things happening at once. Microsoft has been steadily widening what counts as a disclosed CVE (including lower-severity issues that used to get folded into a version bump without a dedicated number), acquiring and integrating more product lines that now report through the same disclosure pipeline, and facing a security research community — both independent researchers chasing bug bounties and nation-state-adjacent groups — that’s larger and better resourced than it’s ever been. None of that changes the practical math for a small shop: more disclosed flaws in a single release means more decisions compressed into the same day, and a bigger batch is objectively easier to partially skip than a normal one, because there’s more of it to skim past.
It’s also worth separating “record-setting count” from “record-setting danger.” Most Patch Tuesdays, including this one, are dominated by moderate and low-severity issues that matter enormously to enterprise security teams tracking defense-in-depth across thousands of machines, and much less to a five-person shop with four computers. The signal worth actually acting on isn’t the 964 — it’s the two confirmed zero-days and the three “Exploitation More Likely” flags. Everything else in the batch gets fixed by the same one restart; you don’t need to evaluate 964 line items individually, you need the update to actually finish applying.
Setting up unattended patching so this isn’t a monthly fire drill
The single highest-leverage change a small shop can make here isn’t reading every Patch Tuesday writeup — it’s removing the human step that keeps failing. A few concrete options, roughly in order of effort:
- Turn on automatic restarts outside business hours. Windows Update lets you set “active hours” so it won’t force a restart while the POS terminal is mid-transaction, but will restart automatically overnight once a patch is downloaded. This alone fixes the “pending restart for three weeks” failure mode without anyone having to remember anything.
- Put someone’s name on it, literally. A recurring calendar reminder, the second Wednesday of every month (Patch Tuesday’s actual schedule), assigned to one specific person — not “the team,” not “whoever notices” — to spend ten minutes confirming every machine shows a current build date.
- Consider a low-cost managed patching tool if you’re running more than four or five machines. Once a shop grows past a handful of computers, tools built for exactly this (several offer free tiers for small device counts) turn “check every machine manually” into “check one dashboard,” and catch the machine that silently stopped updating months ago that nobody would otherwise notice.
None of this requires new hardware or a meaningful budget line. It requires converting “we should probably check that” into a system that runs whether or not anyone remembers to think about it that week — which is the same underlying fix that shows up in the Chrome zero-day piece and the small-business data security checklist, because it’s the actual root cause behind most of these stories, not just this one.
One more thing worth doing before you apply a batch this large to a machine you can’t afford to have down: clone the drive first. Microsoft’s testing catches the overwhelming majority of problems before a release ships, but “the overwhelming majority” across 964 changes still leaves a real number of machines that hit trouble mid-restart — a 20-minute clone turns that into a 10-minute drive swap instead of a rebuild from scratch.
When this genuinely isn’t urgent for you
If your business runs entirely on Mac, ChromeOS, or cloud-only software with no Windows machine anywhere in the operation, this specific release doesn’t apply to you — though it’s worth confirming that’s actually true rather than assumed, since a lot of small shops have at least one forgotten Windows box running a label printer, a scale, or older accounting software.
If every machine you run is already on a managed patching service through a legitimate IT provider or MDM, this is exactly the scenario that setup exists for — verify it actually applied (ask for confirmation, don’t just assume), then move on.
If your Windows machines are fully air-gapped from any network — no internet, no local network, genuinely isolated — the two zero-days above require either local access or network reachability to matter, so the urgency is lower, though “how did the last person get a foothold on an air-gapped machine” is usually a physical-access question worth thinking through anyway.
Bottom line
A record-setting 964-CVE Patch Tuesday sounds like a headline built for IT departments, but two of the fixes in it are already being used to escalate a small foothold into full control of a Windows machine — and “small foothold” describes exactly what a phished password, a bad browser extension, or one compromised tab can hand an attacker. Six Chrome zero-days already landed this year on the browser side of this same problem; this is the operating-system-level version of the identical lesson. The fix here is genuinely simple and free — restart the machine, confirm the build date — but it only works if someone actually owns checking it, on a recurring basis, on every machine that touches money or customer data.
Sources
All facts accessed September 11, 2026.
- Critical breakdown and per-product category counts — SecurityWeek, “Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days” (SecurityWeek’s own tally lands at 974 rather than 964 — outlets count differently depending on whether they include re-released or third-party CVEs; this piece uses the 964 figure Microsoft, Tenable, and Malwarebytes converge on)
- CVE-2026-81963 and CVE-2026-85880 technical detail, CVSS scores, and CISA KEV addition — Tenable, “Microsoft’s September 2026 Patch Tuesday Addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)”
- CVE-2026-81963 as the first-ever exploited Windows Update Stack elevation-of-privilege zero-day, and further exploitation analysis — SOC Prime, “CVE-2026-85880 & CVE-2026-81963 Windows Zero-Days Analysis”
- CVE-2026-69730 (DNS Server), CVE-2026-69676 (Kerberos), CVE-2026-69525 (Remote Desktop Services) severity ratings and “Exploitation More Likely” classification — Tenable, “Microsoft’s September 2026 Patch Tuesday Addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)”
- Publish date and CrowdStrike’s independent analysis of the release — CrowdStrike, “September 2026 Patch Tuesday: Updates and Analysis”
- Comparison to the prior record month (July 2026, 569 CVEs) and context on Microsoft’s AI-assisted vulnerability discovery tooling — Malwarebytes, “Microsoft fixes record 964 flaws, including 2 exploited zero-days”
- AppContainer sandbox-escape mechanism for CVE-2026-85880, pre-patch exploitation confirmation, and researcher credits (Volexity, Proofpoint, Romain Deperne/Airbus Helicopters, MSTIC) — Security Online, “September 2026 Patch Tuesday Fixes 2 Exploited Windows Zero-Days”