September 2026 Patch Tuesday: A Record 964 CVEs and Two Exploited Zero-Days

The biggest Patch Tuesday in Microsoft's history

September 2026 set a record. Microsoft patched roughly 964 CVEs in a single Patch Tuesday, the most it has ever released at once, as reported by Malwarebytes and CyberSecurityNews. Tenable's analysis puts it at around 104 critical and the rest important. A month this size is less a patching task than a *triage* task, which is exactly the CySA+ skill.

Two zero-days already being exploited

The headline items are two vulnerabilities confirmed exploited in the wild, both elevation of privilege:

• CVE-2026-81963, an EoP flaw in the Windows Update Stack.
• CVE-2026-85880, an EoP flaw in the Advanced Local Procedure Call (ALPC) component.

Both are called out by Tenable and Security Online. Actively-exploited EoP bugs are the ones attackers chain *after* an initial foothold to become SYSTEM, so they jump the queue regardless of CVSS.

The shape of the risk

CrowdStrike's breakdown is worth internalising:

• Elevation of privilege made up ~44.7% of the fixes, the largest category.
• Remote code execution was ~26.8%.
• Unauthenticated, network-reachable RCE spanned core infrastructure services, DNS, DHCP, MSMQ, NFS, and SSTP VPN, and there were critical RCEs in Netlogon and Kerberos, the identity plumbing itself.

That combination, mass EoP plus unauthenticated RCE on exposed services plus identity-component RCE, is the profile of a month where prioritisation matters more than volume.

How to triage a month like this

You cannot test and deploy ~964 fixes at once. Prioritise by *exploitability and reachability*, not raw CVSS:

1. Actively-exploited zero-days first, CVE-2026-81963 and CVE-2026-85880. Cross-reference the CISA Known Exploited Vulnerabilities catalog; "exploited in the wild" outranks a higher CVSS that no one is using.
2. Unauthenticated, network-reachable RCE on exposed services next, the DNS/DHCP/MSMQ/NFS/SSTP set from CrowdStrike's list. Anything an unauthenticated attacker can reach across the network is a pre-auth foothold.
3. Identity-component RCE (Netlogon, Kerberos), high blast radius; a compromise here is domain-wide.
4. The EoP bulk, real, but generally requires an existing foothold, so it follows the pre-auth items.

One caveat worth flagging to your change board: one of this month's updates, KB5124008, also introduced a domain-trust regression, see our write-up on the KB5124008 secure-channel failure. Patching fast is right; patching *blind* is how you trade a vulnerability for an outage.

Study the reasoning, not the CVE numbers

Specific CVEs age out; the triage method does not. Being able to explain *why* an exploited EoP or an unauthenticated RCE outranks a higher-scored bug nobody is exploiting is exactly what the CompTIA CySA+ and Security+ exams test under vulnerability management. The free domain summaries show how heavily each exam weights it.