Microsoft Patch Tuesday hits record 974 CVEs

Microsoft published 974 own-product CVEs on 8 September 2026, including 723 in Windows, Rapid7's September 2026 Patch Tuesday analysis says. With 25 non-Microsoft CVEs, Rapid7 puts 999 vulnerabilities on the table. SecurityWeek also leads on 974. Whether the release is a record depends on the count: 974 is own-product, and 999 includes third-party CVEs.

Two elevation-of-privilege bugs are already exploited in the wild. CVE-2026-85880 is a Windows ALPC heap-based buffer overflow to SYSTEM, marked Exploitation Detected. SecurityWeek quotes Microsoft: a low-privilege AppContainer attacker can escape the sandbox and elevate locally with no extra user interaction. Rapid7 reads the patch matrix as giving Server 2025 and Windows 11 no patch for this CVE, which is Rapid7's inference rather than a named Microsoft statement.

CVE-2026-81963 is a Windows Update Stack improper link resolution EoP to SYSTEM. Rapid7 says all supported Windows versions get a patch. Microsoft has not named the actor behind either zero-day.

CISA added both Microsoft bugs to the Known Exploited Vulnerabilities catalog on 8 September. The Register reports a 22 September 2026 federal remediation deadline for those two.

SecurityWeek, citing ZDI's Dustin Childs, puts about 20 of the fixes in the wormable RCE class. Rapid7 flags Windows DNS Server CVE-2026-69730 at CVSS 9.8 (Exploitation More Likely) and Exchange Server CVE-2026-55007 as an RCE often called out in the same pile.

Some offers on this page may be paid placements or contain affiliate links.