Future TechnologyMicrosoft patched 974 flaws in one day. Only two were being exploited.
Future Technology
New article published
SECURITY
Microsoft patched 974 flaws in one day. Only two were being exploited.
Microsoft's September 2026 Patch Tuesday closed a record 974 CVEs, more than double August's 421. Two are under active attack. Why the count is climbing and what to fix first.
Key Takeaways
- Microsoft closed 974 CVEs on 8 September 2026, more than double the 421 record set in August
- Two are actively exploited: CVE-2026-85880 in Windows ALPC and CVE-2026-81963 in the Windows Update Stack, both local privilege escalation to SYSTEM
- Both are in CISA's Known Exploited Vulnerabilities catalog, with a 22 September deadline for federal civilian agencies
- Around 20 of the fixes are potentially wormable and 58 more are rated more likely to be exploited, so triage by exposure rather than by raw count
You received this because you subscribe to Future Technology.