Vulnerabilities · 49 days ago
Microsoft's September Patch Tuesday fixes 974 vulnerabilities, including two Windows zero-days the company says are being exploited in the wild. Both flaws allow local privilege escalation, meaning an attacker with code running on a host can gain higher privileges.
CVE-2026-85880 affects Windows Advanced Local Procedure Call (ALPC), a system communication mechanism. Code already running inside Windows' AppContainer sandbox can exploit it to escape the sandbox and gain SYSTEM privileges, without another user click. CVE-2026-81963 affects the Windows Update Stack and also lets an authorized local attacker gain SYSTEM privileges.
For Windows estates working through the release in bulk, these two fixes carry a distinct exposure: a low-privilege foothold can become SYSTEM-level control. Microsoft has not said who was targeted or whether any attacks succeeded.
Known exploited · CISA KEV
CVSS 7.8 HIGH: improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker… Microsoft patch: 5122871.
Patch available KB5122871 Download →
CISA federal remediation date Sep 22
Known exploited · CISA KEV
CVSS 7.8 HIGH: heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. Microsoft patch: 5122876.
Patch available KB5122876 Download →
CISA federal remediation date Sep 22
9 sources covering this story
Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
Microsoft patches a record 974 vulnerabilities, including two Windows zero-days exploited in the wild.
Microsoft Releases September 2026 Security Updates
JPCERT-AT-2026-0025 JPCERT/CC 2026-09-09 Microsoft Corporation September 2026 Security Updates https://msrc.microsoft.com/update-guide/en-US/releaseNote/2026-Sep According to Microsoft, among the vulnerabilities, the following vulnerability has been confirmed to be exploited in…
Microsoft discloses two actively exploited zero-days among 974 vulnerabilities
While the vendor hit another monthly record, it hasn’t resulted in a flood of active exploits. Researchers encourage customers to focus on their specific areas of risk and exposure.
Microsoft Plugs Nearly 1,000 Security Holes
today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever.
Why this month's Microsoft patch release is a doozy
Security gnomes are pumping out patches ahead of an expected onslaught of AI-assisted attacks.
Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days
The record-breaking September security update fixes two exploited privilege-escalation zero-days and 20 potentially wormable vulnerabilities.
Kwetsbaarheden verholpen in Microsoft Windows Revisies
Microsoft heeft 666 kwetsbaarheden verholpen in Windows.
Kwetsbaarheden verholpen in Microsoft Office
Microsoft heeft 114 kwetsbaarheden verholpen in diverse Office producten.
Kwetsbaarheden verholpen in Microsoft Developer Tools
Microsoft heeft 15 kwetsbaarheden verholpen in diverse Developer Tools.
Kwetsbaarheden verholpen in SQL Server
Microsoft heeft 62 kwetsbaarheden verholpen in diverse componenten van SQL Server.
Kwetsbaarheden verholpen in Microsoft Exchange server
Microsoft heeft 9 kwetsbaarheden verholpen in Exchange Server.
Kwetsbaarheden verholpen in Microsoft Dynamics
Microsoft heeft 2 kwetsbaarheden verholpen in Dynamics, zowel online als on-premise.
Part of the PlainSec briefing for 2026-09-09