Microsoft’s September 2026 Patch Tuesday set a new volume record. Rapid7 counts 974 Microsoft product CVEs in the drop (plus 25 non-Microsoft fixes for ~999 on the table); Tenable’s tally is 964 depending on how Edge/Chromium rows are counted. Either way it dwarfs recent months and is the most CVEs Microsoft has published in a single Patch Tuesday.
Two bugs are confirmed exploited in the wild before the patches shipped. CVE-2026-85880 is a Windows Advanced Local Procedure Call (ALPC) elevation of privilege (CVSS 7.8). A local attacker with low-privilege or AppContainer code execution can trigger a heap-based buffer overflow and reach SYSTEM with no extra user interaction. CVE-2026-81963 is a Windows Update Stack elevation of privilege (CVSS 7.8) via improper link resolution — also to SYSTEM, also Exploitation Detected. CISA added both (and Adobe’s StyleSmuggler) to the Known Exploited Vulnerabilities catalog, with a September 22 deadline for the Microsoft pair.
Beyond the zero-days, operators should still triage the high-impact non-zero-day rows researchers are flagging: Exchange Server CVE-2026-55007 (Visio-attachment RCE path during content indexing, no user click required once mail is accepted — Microsoft says hard to trigger reliably); Windows DNS Server CVE-2026-69730 (CVSS 9.8, Exploitation More Likely); and a cluster of wormable-class RCEs ZDI counted at about 20 across DHCP, DNS, SMB, Netlogon, NFS, RRAS and peers. Patch Tuesday volume is the story — patch priority is still the two KEV EoPs, then internet-facing roles.
The sourced facts: record CVE volume (Rapid7 974 / Tenable 964), Microsoft Exploitation Detected on CVE-2026-85880 and CVE-2026-81963, CISA KEV with Sep 22 federal deadline, with victim counts and attribution Undisclosed. Ship the monthly cumulatives.