Skip to content
Auto-CTI
Back to all deep dives
MALWAREBYTES

Microsoft fixes record 964 flaws, including 2 exploited zero-days

CRITICAL Patch Tuesday Zero-day Windows Privilege Escalation

Strategic summary

Microsoft's September 2026 Patch Tuesday fixes 964 CVEs, the largest release on record, including 104 rated critical and 860 rated important. The update addresses two actively exploited zero day vulnerabilities that allow local privilege escalation to SYSTEM, but provide no remote access by themselves. It also includes high severity remote code execution flaws in Windows DNS Server and Remote Desktop Services, along with fixes for Exchange Server, SharePoint, SQL Server, Office, and core Windows components. Customers should apply the updates via Windows Update and verify that their systems are up to date.

Key findings

  • Microsoft released its largest Patch Tuesday ever in September 2026, with 964 customer applicable CVEs, of which 104 are Critical and 860 are Important.
  • Two actively exploited zero days are local elevation of privilege vulnerabilities: an improper link resolution issue in Windows Update Stack and a heap based buffer overflow in Windows ALPC (CVE-2026-85880).
  • Both zero days have a CVSS score of 7.8 and let attackers who already have device access gain SYSTEM privileges, but they do not provide remote access on their own.
  • The release also contains high severity remote code execution vulnerabilities in Windows DNS Server and Remote Desktop Services, as well as updates for Exchange Server, SharePoint, SQL Server, Office, and core Windows components.
  • Users should check for updates in Windows Update, restart if required, and confirm the system shows 'You're up to date' after installation.

Relevance for you

Both zero-days are local privilege-escalation vulnerabilities that can escalate existing low-privilege code execution to SYSTEM rights , typically relevant as a second stage in exploit chains or post-compromise scenarios.

Risk score

70
cvss base
45.00
kev bonus
0.00
epss bonus
0.00
poc bonus
15.00
raw before weight
60.00
industry weight
1.21
freshness factor
1.00
exploitability factor
1.00
days old
0.00
vendor mismatch penalty
0.00
consensus penalty
-3.00

Path: operational

Consensus check

The pipeline self-checks before delivery. These rules lowered the score:

  • TTP_SKIPPED TTP mapping skipped (placeholder or aggregation article) −3
Consensus penalty:
−3.0
Total penalty:
−3.0
ESC

…