Microsoft Releases Record September Patch Tuesday Fixing 900+ Flaws Including Two Exploited Zero-Days
Microsoft has issued its largest Patch Tuesday update to date, addressing over 900 vulnerabilities including two actively exploited zero-day flaws. The update highlights the increasing complexity of software security as AI-assisted vulnerability research becomes more prevalent.
Why it matters
The scale of these vulnerabilities and the fact that they are being actively exploited poses a significant security risk to organizations and individual users worldwide.
Microsoft has released its largest Patch Tuesday security update to date, addressing over 900 vulnerabilities across Windows and other products, including two privilege-escalation flaws that attackers were already exploiting before fixes became available.
The unprecedented September 2026 release contains 105 vulnerabilities classified as Critical, including dozens of weaknesses capable of enabling remote code execution. Hundreds of additional flaws could allow attackers to elevate privileges, disclose sensitive information, bypass security protections, impersonate trusted entities or disrupt affected systems.
The two actively exploited zero-days, tracked as CVE-2026-81963 and CVE-2026-85880 , affect fundamental Windows components and could allow attackers who already have some access to a device to obtain SYSTEM-level privileges. SYSTEM is one of the most powerful security contexts in Windows and can give an attacker extensive control over the operating system.
Also covering this story
2 other newsrooms covered this event. We read each version separately.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in