Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
Summary: Microsoft's September Patch Tuesday addressed 974 vulnerabilities, including 723 in Windows, 111 in Office and Office 2016, 62 in SQL, and 22 in Developer Tools, with over 110 rated critical. Two flaws were actively exploited in the wild: CVE-2026-85880, a local AppContainer sandbox escape requiring no user interaction, and CVE-2026-81963 in the Windows Update Stack, the first zero-day of seven privilege escalation flaws there since 2022.
What's compelling: CISA added both exploited flaws to its KEV catalog and set a September 22, 2026 deadline for Federal Civilian Executive Branch agencies, while Microsoft disclosed no details on who is exploiting them or whether any victims were breached. Tenable's count puts this month nearly 70% above the prior record of 569 in July, and the year's total above 2,600 with three months left.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-21674CVE-2026-81963CVE-2026-85880
- Related
- Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities Cyber Risks ·Microsoft Plugs Nearly 1,000 Security Holes Cyber Risks ·