September 2026 Patch Tuesday: A Record 964 CVEs and Two Exploited Zero-Days

The biggest Patch Tuesday in Microsoft's history

September 2026 set a record. Microsoft patched roughly 964 CVEs in a single Patch Tuesday — the most it has ever released at once, as reported by [Malwarebytes](https://www.malwarebytes.com/blog/news/2026/09/microsoft-fixes-record-964-flaws-including-2-exploited-zero-days) and [CyberSecurityNews](https://cybersecuritynews.com/microsoft-patch-tuesday-update-september-2026/). [Tenable's analysis](https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880) puts it at around 104 critical and the rest important. A month this size is less a patching task than a *triage* task — which is exactly the CySA+ skill.

Two zero-days already being exploited

The headline items are two vulnerabilities confirmed exploited in the wild, both elevation of privilege:

CVE-2026-81963 — an EoP flaw in the **Windows Update Stack**.

CVE-2026-85880 — an EoP flaw in the **Advanced Local Procedure Call (ALPC)** component.

Both are called out by [Tenable](https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880) and [Security Online](https://securityonline.info/patch-tuesday-zero-day-september-2026/). Actively-exploited EoP bugs are the ones attackers chain *after* an initial foothold to become SYSTEM, so they jump the queue regardless of CVSS.

The shape of the risk

[CrowdStrike's breakdown](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-september-2026/) is worth internalising:

Elevation of privilege made up ~44.7% of the fixes — the largest category.

Remote code execution was ~26.8%.

That combination — mass EoP plus unauthenticated RCE on exposed services plus identity-component RCE — is the profile of a month where prioritisation matters more than volume.

How to triage a month like this

You cannot test and deploy ~964 fixes at once. Prioritise by *exploitability and reachability*, not raw CVSS:

1. Actively-exploited zero-days first — CVE-2026-81963 and CVE-2026-85880. Cross-reference the [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog); "exploited in the wild" outranks a higher CVSS that no one is using.

2. Unauthenticated, network-reachable RCE on exposed services next — the DNS/DHCP/MSMQ/NFS/SSTP set from [CrowdStrike's list](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-september-2026/). Anything an unauthenticated attacker can reach across the network is a pre-auth foothold.

3. Identity-component RCE (Netlogon, Kerberos) — high blast radius; a compromise here is domain-wide.

4. The EoP bulk — real, but generally requires an existing foothold, so it follows the pre-auth items.

One caveat worth flagging to your change board: one of this month's updates, KB5124008, also introduced a domain-trust regression — see [our write-up on the KB5124008 secure-channel failure](/blog/kb5124008-domain-trust-failure). Patching fast is right; patching *blind* is how you trade a vulnerability for an outage.

Study the reasoning, not the CVE numbers

Specific CVEs age out; the triage method does not. Being able to explain *why* an exploited EoP or an unauthenticated RCE outranks a higher-scored bug nobody is exploiting is exactly what the [CompTIA CySA+](/certifications/cysa_plus) and [Security+](/certifications/security_plus) exams test under vulnerability management. The [free domain summaries](/domain-summaries) show how heavily each exam weights it.