Securify

Microsoft’s September 2026 Patch Tuesday has shattered every previous record, addressing a staggering 973 security vulnerabilities across its product ecosystem — nearly double August’s 421 fixes and far surpassing July’s then-record 570. Among the flood of patches are two actively exploited zero-days already added to CISA’s Known Exploited Vulnerabilities catalog, 113 critical-severity flaws, and 20 wormable vulnerabilities that can spread across networks without any user interaction. If your organization runs Windows, this is the most consequential patch cycle in Microsoft’s history.

What Happened

On September 8, Microsoft released its monthly security update covering Windows, Office, SQL Server, Exchange Server, Azure, SharePoint, Hyper-V, and developer tools. The sheer volume — attributed in part to Microsoft’s expanded use of AI-assisted vulnerability discovery across its codebase — represents a paradigm shift in how quickly vendors can identify and disclose flaws. The breakdown by vulnerability type tells a clear story: 438 elevation-of-privilege bugs, 253 remote code execution flaws, 173 information disclosure issues, 56 denial-of-service vulnerabilities, 19 security feature bypasses, and 16 spoofing bugs.

The Two Zero-Days Under Active Exploitation

Two vulnerabilities were already being exploited in the wild before patches shipped, and CISA has mandated federal agencies patch both by September 22.

CVE-2026-81963 — Windows Update Stack Elevation of Privilege (CVSS 7.8): This flaw exploits improper link resolution before file access in the Windows Update Stack. An authenticated attacker with local access can follow a crafted symbolic link to escalate from low privileges to SYSTEM. It affects Windows 11 (versions 23H2, 24H2, 25H2, and 26H1) and Windows Server 2025. Because it targets the update mechanism itself, exploitation could allow attackers to tamper with the patching process — an especially dangerous foothold.

CVE-2026-85880 — Windows ALPC Elevation of Privilege (CVSS 7.8): A heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) allows code running inside a low-privilege AppContainer sandbox to escape its restrictions and achieve SYSTEM-level access. Notably, this flaw affects only Windows 10 and Windows Server 2012 through 2022; Windows 11 is not impacted. Organizations still running Windows 10 — which remains widespread in enterprise environments — should treat this as an urgent priority.

20 Wormable Flaws: Echoes of WannaCry

Perhaps the most alarming aspect of this update is the 20 vulnerabilities classified as wormable — meaning they can be exploited remotely, without authentication, and without any user interaction. These primarily target core Windows Server infrastructure services:

Windows DNS Server received patches for multiple critical use-after-free vulnerabilities (including CVE-2026-69730, rated CVSS 9.8) that allow unauthenticated remote code execution over the network. Given that DNS servers are reachable by design, these flaws represent an immediate risk to any organization running Windows DNS.

Windows DHCP Server was hit with dozens of vulnerabilities, including heap-based buffer overflow and use-after-free flaws enabling network-based code execution. DHCP services are ubiquitous in enterprise networks and typically trusted implicitly — exactly the kind of attack surface that worms exploit.

Additional wormable flaws span Routing and Remote Access Service (RRAS), Netlogon, NFS, MSMQ, and SSTP VPN — all scoring CVSS 9.8. Security researchers have drawn comparisons to the conditions that enabled WannaCry’s devastating spread in 2017. While no active worm has been observed yet, the combination of unauthenticated remote exploitation across multiple core services is a powder keg.

Other Critical Risks Worth Noting

Beyond the zero-days and wormable flaws, several other vulnerability clusters deserve attention:

Preview Pane attacks in Office: Twelve Microsoft Office vulnerabilities can be triggered merely by previewing a malicious file in Outlook or Explorer — no click required. Excel received 32 critical patches and Word received 38, many enabling malicious document exploitation. One particularly dangerous flaw, CVE-2026-78509, allows remote code execution simply by reading a crafted email in Outlook.

Identity-layer compromise: Critical vulnerabilities in Netlogon and Kerberos could give attackers a foothold inside the authentication layer that every domain service trusts — a nightmare scenario for Active Directory environments.

Hyper-V escapes: Guest-to-host escape vulnerabilities could allow an attacker who compromises a virtual machine to break out and take over the hypervisor host — and with it, every other VM running on that server.

Windows Biometric Service: A surprising 64 vulnerabilities were patched in the biometric authentication subsystem, suggesting systemic weaknesses in Windows Hello’s fingerprint and facial recognition stack.

What Defenders Should Do Now

Given the unprecedented scale of this update, a prioritized approach is essential:

Immediate (within 48 hours): Patch the two zero-days (CVE-2026-81963 and CVE-2026-85880) on all affected systems. Apply fixes for network-accessible services — DNS, DHCP, RRAS, and Netlogon — especially on internet-facing and domain controller servers.

High priority (within one week): Address the remaining critical remote code execution vulnerabilities, particularly those affecting Office applications and the Windows Imaging Component. Disable Preview Pane in Outlook as a temporary mitigation if patching is delayed.

Secondary (within two weeks): Deploy the 27 critical privilege escalation patches for Windows kernel and core services. Address Hyper-V escape flaws in virtualized environments.

Organizations that cannot patch immediately should note that Qualys has released 468 mitigation signatures to reduce exposure while remediation is underway. Additionally, network segmentation limiting access to DNS, DHCP, and RRAS services can meaningfully reduce the wormable attack surface.

The Bigger Picture

This record-breaking Patch Tuesday reflects a broader shift. Microsoft’s use of AI-assisted vulnerability discovery is surfacing flaws at an unprecedented rate — which is ultimately a good thing, even if the patch volume is daunting. Better to find and fix these issues than to leave them for attackers to discover first. But it also means defenders must adapt: patch management processes designed for monthly cycles of 50–100 fixes are buckling under nearly 1,000. Automation, risk-based prioritization, and rapid testing pipelines are no longer optional — they’re survival skills.

With two zero-days already in play, 20 wormable flaws waiting for exploit code, and CISA’s September 22 deadline approaching fast, the clock is ticking. Patch now.