Microsoft Patch Tuesday Breaks Records: 974 CVEs and Two Exploited Zero-Days

Microsoft's September 2026 Patch Tuesday is the largest single security release the company has ever shipped: 974 vulnerabilities fixed in one day, two of them already under active attack. That number is not the story a defender needs, though. The story is the triage problem it creates. When a routine month is 100 to 200 fixes and this one is 974, the job is not "apply everything by tonight." It is knowing which handful to move on first, and which of the rest can ride the normal deployment cycle.

This piece does the sorting the raw advisory list does not. Microsoft's release notes hand you 974 line items in a filterable grid, and the wire reports hand you the headline count. What follows is the defender's order of operations: the two exploited zero-days and the Microsoft Defender bypass to verify first, the small set of critical remote code execution flaws next, and a staged plan for the long tail after that. Every figure here traces to Microsoft's own advisories and the reporting that broke the release.

What Microsoft Shipped This Week

Microsoft resolved 974 CVEs on Tuesday, September 9, 2026, its single biggest Patch Tuesday on record. Two of the flaws were being exploited in the wild when the patches landed, both of them local privilege-escalation bugs in Windows. The company said it had detected the exploitation but, as is standard for an active-threat advisory, did not name who was behind it or how many organizations were hit.

The record is not a counting artifact. Tallying only Microsoft's own products, the figure is 974. Fold in 25 third-party CVEs that Microsoft rebundles (mostly Chromium fixes that flow into Edge) and the day's total reaches 999, per The Hacker News. For scale, Microsoft patched 457 flaws in August and 663 in July. September nearly doubled the heavier of those two months, and it did so in a single release.

The 974, Broken Down by Product Family

The volume concentrates in Windows. Of the 974 CVEs, 723 are Windows flaws, 111 sit in Office and Office 2016, 62 are in SQL, and 22 are in Developer Tools, per Microsoft's release notes as summarized by The Hacker News and Help Net Security. More than 110 carry Microsoft's critical severity rating. Three bug classes, privilege escalation, remote code execution, and information disclosure, together account for close to 90 percent of the batch.

The split also tells you who does the work. The 723 Windows fixes land mostly on your endpoint and server teams. The 111 Office and Office 2016 CVEs are a client-side patching and macro-hygiene problem. The 62 SQL fixes belong to your database administrators and the app owners who depend on those instances, and the 22 Developer Tools flaws touch build agents, Visual Studio installs, and CI runners that security teams often do not inventory at all. Routing each family to its real owner on day one, rather than dumping 974 undifferentiated tickets into one queue, is half the battle in a month this size, because the bottleneck is rarely the patch itself and almost always the coordination.

Two numbers inside that breakdown matter more than the headline. The first is "more than 110 critical," because that is the realistic upper bound on what most teams should treat as urgent this cycle. The second is "two," the count of flaws with confirmed real-world exploitation. A CVE that is critical but not yet exploited is a scheduling problem. A CVE that is exploited is a right-now problem, whatever its CVSS score. Both of this month's exploited bugs are rated 7.8, not 9-point-anything, which is exactly why a score-only triage would rank them below dozens of flaws that no one is actually attacking.

The Two Zero-Days Microsoft Says Are Under Attack

Microsoft flagged two vulnerabilities as exploited in the wild, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has already added both to its Known Exploited Vulnerabilities (KEV) catalog, with a September 22, 2026 remediation deadline for federal civilian agencies. That deadline is the single most useful date in this release. If your patch program mirrors the federal KEV clock, these two are your two-week must-fix, and the deadline gives you a defensible service-level target even in a private-sector shop.

• CVE-2026-85880 (CVSS 7.8) is a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem that lets an already-authorized local user elevate to SYSTEM. Microsoft's advisory states the impact plainly: "An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system," and adds that "no additional user interaction is required." Volexity and Proofpoint were credited with reporting it.
• CVE-2026-81963 (CVSS 7.8) is an improper link-resolution flaw in the Windows Update Stack, again a local elevation to SYSTEM. Every supported Windows version receives a fix. Microsoft's Threat Intelligence Center (MSTIC) and a researcher at Airbus Helicopters were credited. Per Tenable, it is the first Windows Update Stack privilege-escalation bug to be exploited as a zero-day, out of seven found in that component since 2022.

Both are local, not remote. That is not a reason to relax. Privilege escalation is the second half of nearly every intrusion, the step that turns a phishing foothold or a low-privilege web shell into full control of the host. Attackers pair bugs like these with an initial-access flaw precisely because Microsoft rates them "only" 7.8, which is how they slip past teams that sort by score alone. If you want the conceptual difference between a flaw, an exploit, and an attack, our guide to zero-days versus vulnerabilities versus attacks lays it out. The short version: these two have crossed from vulnerability into active exploit, and that crossing is what moves them to the front of the line.

From ShieldBreak to ShieldCrash: The Defender Bypass to Verify

One item worth pulling forward does not appear in this month's CVE grid at all. It is a proof-of-concept named ShieldCrash, and it targets the fix for an earlier Microsoft Defender flaw, CVE-2026-69414, that we have been tracking as ShieldBreak. ShieldCrash, published by a group we have followed as Nightmare Eclipse, is a patch-bypass. It is built to defeat the remediation Microsoft already shipped for ShieldBreak, which means an environment that patched ShieldBreak and closed the ticket may not be as covered as its change log suggests.

We are not going to walk through how the bypass works, and the defender action here is not exotic. Confirm the running Microsoft Defender platform, engine, and security-intelligence versions across your fleet against Microsoft's current published builds, rather than trusting that a months-old patch entry still holds. A patch-bypass is a reminder that "we applied the update" and "we are protected" are two different claims, and only the version check settles the second one. This fits a pattern we covered when Check Point showed Defender's signed BTR.sys driver could be weaponized in the kernel: the security tool itself is now part of the attack surface it is meant to defend.

What Enterprise Windows Fleets Should Verify First

The practical takeaway is an order of operations, not a demand to deploy 974 patches overnight. The diagram below is the sequence we would run, and the four moves under it are the same list in words.

1. Pull the September advisory bundle and isolate the two KEV entries. Filter Microsoft's release notes to CVE-2026-85880 and CVE-2026-81963 and schedule them against the September 22 federal deadline, whether or not you are federal. These are the flaws with confirmed exploitation, so they lead regardless of their 7.8 score.
2. Verify Microsoft Defender against the ShieldCrash bypass. Check platform, engine, and signature versions fleet-wide. A patch-bypass proof-of-concept means the ShieldBreak (CVE-2026-69414) fix needs re-confirmation, not an assumption that it still holds.
3. Rank the critical remote code execution flaws by reachability. More than 110 CVEs are critical this month, and several are network-exploitable, unauthenticated RCEs rated 9.8: Windows DNS Server (CVE-2026-69730), Windows DHCP Server (CVE-2026-72979), Remote Desktop Services (CVE-2026-69525), the Windows NFS ONCRPC XDR driver (CVE-2026-69595), and Windows Shell (CVE-2026-69829), plus a critical SQL Server elevation (CVE-2026-65669) and an Exchange Server code-execution bug (CVE-2026-55007). Prioritize the instances exposed to untrusted networks over internal-only systems.
4. Stage the remaining flaws through your normal rings. The long tail is real work but not an emergency. A ringed rollout (pilot, then broad, then the rest) is the right cadence, and it is the discipline our vulnerability management guide is built around.

As Jack Bicer, director of vulnerability research at Action1, put it in comments reported by The Hacker News: "At this scale, the challenge is not simply getting through the patch list but knowing what needs attention first. With hundreds of updates landing at once, IT and security teams need to quickly separate the vulnerabilities that demand immediate action from those that can follow the normal deployment cycle." That separation is the whole game this month.

A Record That Keeps Breaking

September's 974 is the newest peak in a line that has climbed all year, and the climb is the real trend, not any single month. Microsoft has now patched more than 2,600 flaws in 2026, already more than double its previous full-year record, with three months still to run, according to Tenable's Satnam Narang. The Zero Day Initiative put Microsoft's year-to-date total even higher, at roughly 2,760. The direction is what matters: monthly counts that used to top out in the low hundreds now routinely clear 400, and this month cleared 900.

My read, and this is assessment rather than reported fact: the raw number has stopped being a useful signal on its own. A month of 974 fixes and a month of 200 can carry the same real-world urgency when the exploited count is similar, and this month it was two either way. The rising totals mostly reflect Microsoft and other large vendors finding and closing long-standing bugs faster, some of it with AI-assisted discovery, which is a good thing arriving at an uncomfortable pace. The defender skill that matters is not reading the headline number, it is filtering it. We made the same point from a different angle in our look at August's most-exploited CVEs, where the damage came not from the newest or highest-scored flaws but from patches defenders already had and had not applied.

What We Still Do Not Know

Several load-bearing questions remain open, and they are worth stating plainly rather than papering over:

• Who is exploiting the two zero-days. Microsoft confirmed active exploitation but named no threat actor, gave no scale, and did not say whether any organization has been successfully breached.
• Whether more of the 974 will follow. Confirmed exploitation stands at two. That can change as researchers and attackers work through a release this large, and the critical, network-reachable RCEs are the obvious candidates to watch.
• How widely ShieldCrash has spread. The bypass exists as a proof-of-concept. Whether it is being folded into real intrusions against unverified Defender deployments is not established.

None of that changes the order of operations above. The two KEV flaws and the Defender version check are the same first moves whether attribution ever arrives or not. We will update this story if Microsoft or CISA publishes more on the exploited pair. Recent history says be ready for revisions: in August, Microsoft added, then reversed, an exploited-in-the-wild flag on a maximum-severity Entra ID flaw, a change that cost defenders a scramble over an emergency the company later said never happened.

Primary Documents

• Microsoft Security Response Center: September 2026 Security Update release notes
• MSRC advisory: CVE-2026-85880 (Windows ALPC)
• MSRC advisory: CVE-2026-81963 (Windows Update Stack)
• CISA Known Exploited Vulnerabilities (KEV) catalog
• The Hacker News: Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
• Help Net Security: September 2026 Patch Tuesday
• Infosecurity Magazine: Microsoft Patch Tuesday sets a record
• The Register: Microsoft breaks Patch Tuesday record with 974-CVE deluge