Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

Key Points:

• Microsoft released its largest-ever Patch Tuesday update in September 2026, addressing a record-breaking 966 security vulnerabilities across its software products, including 105 classified as "Critical."
• The update fixes two actively exploited zero-day elevation of privilege vulnerabilities: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call (ALPC), both allowing attackers to gain SYSTEM privileges.
• The surge in identified vulnerabilities is attributed to Microsoft's adoption of an AI-powered vulnerability discovery system, significantly increasing the number of flaws detected and patched compared to previous months.
• Other major technology vendors also released security updates in August 2026, including Adobe, Cisco, Google, Hewlett Packard Enterprise, and SAP, addressing critical zero-day flaws and remote code execution vulnerabilities.
• Microsoft’s September Patch Tuesday does not include 204 other flaws fixed earlier in the month affecting products like Azure AI, Microsoft Edge, and Power Automate, highlighting an ongoing effort to rapidly address security issues.