Microsoft's September Patch Tuesday is unusually large: the company addressed a record 974 vulnerabilities across Windows, Office, SQL Server, developer tools, Exchange, SharePoint, and related components. For security teams, the headline number is less important than the operational signal inside it: two Windows flaws are already being exploited in the wild, and several critical remote-code-execution issues could become high-value targets once exploit details mature.
The practical takeaway is straightforward: treat the two exploited Windows privilege-escalation bugs as emergency patching candidates, then use exposure-based prioritization for the rest of the month’s very large patch set. Attempting to treat nearly one thousand fixes as equally urgent will slow response and increase the chance that the most relevant vulnerabilities remain open on internet-facing or high-value systems.
What Microsoft fixed this month
The update spans a broad portion of Microsoft’s software portfolio. According to the report, Windows accounts for the majority of the fixes, followed by Office and Office 2016, SQL Server, and developer tools. More than 110 vulnerabilities were rated critical, and the most common classes include privilege escalation, remote code execution, and information disclosure.
That distribution matters. Privilege-escalation flaws are often used after an attacker has already gained a foothold through phishing, stolen credentials, browser exploitation, or exposed services. Remote-code-execution flaws, especially in server components, are more likely to draw scanning and weaponization attempts if they are reachable across a network. Information-disclosure bugs may appear less dramatic, but they can still support credential theft, bypasses, or chained exploitation.
The exploited zero-days to patch first
The two vulnerabilities Microsoft says have been exploited are both local privilege-escalation issues with CVSS scores of 7.8. CVE-2026-85880 affects Windows Advanced Local Procedure Call and is described as a heap-based buffer overflow that can let an authorized local attacker obtain SYSTEM privileges. Microsoft’s advisory indicates that an attacker running code in a low-privilege AppContainer could use the bug to escape the sandbox without additional user interaction.
CVE-2026-81963 affects the Windows Update Stack and involves improper link resolution. The risk is that an authorized attacker could elevate privileges locally and gain SYSTEM-level control. The report notes that supported Windows versions receive a patch, and that the fix appears intended to prevent the Windows Update Stack from following malicious links in a way that could overwrite a system component with attacker-controlled content.
Both issues have also been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, with federal civilian agencies directed to remediate them by September 22, 2026. Even for organizations not bound by that deadline, KEV inclusion is a strong signal for expedited action.
Other high-risk issues to triage
After the exploited zero-days, defenders should identify whether they run affected versions of Exchange Server, SharePoint, SQL Server, Remote Desktop Services, Windows DNS Server, Windows DHCP Server, Windows Services for NFS, and related Windows components. The September batch includes multiple critical flaws that could allow remote code execution or privilege escalation over a network, including issues in Windows Remote Desktop Services, the Windows DNS server, Windows DHCP Server, and Windows Shell.
The right order will differ by environment. A vulnerable DNS, DHCP, RDP, or file-services component exposed to untrusted networks deserves faster attention than a component that is installed only on isolated lab systems. Likewise, Exchange and SharePoint should be assessed based on whether they are externally reachable, how authentication is enforced, and whether compensating controls such as segmentation, web application firewalls, and endpoint detection are in place.
Recommended response plan
Start with asset inventory. Confirm which Windows endpoints, servers, Office deployments, SQL instances, and collaboration platforms are in scope. Do not rely only on patch management dashboards; cross-check with vulnerability scanning, endpoint management, and cloud inventory where possible.
Next, fast-track the two exploited Windows zero-days to workstations, virtual desktop infrastructure, jump boxes, administrator workstations, and servers used for sensitive operations. Because both flaws are local privilege-escalation bugs, they are especially concerning on machines where users browse the web, open documents, administer infrastructure, or handle privileged sessions.
Then, prioritize critical remotely exploitable server-side vulnerabilities by exposure. Internet-facing systems should be patched or otherwise mitigated first. Internal-only systems should still be updated, but sequencing can account for reachability, business criticality, and maintenance windows. Where patching must be delayed, reduce attack surface by limiting inbound access, disabling unnecessary services, enforcing least privilege, and monitoring for suspicious service crashes or privilege escalation behavior.
Finally, verify deployment. For Windows fleets, confirm update installation status, reboot completion, and health of dependent services. For servers such as SQL, DNS, DHCP, Exchange, SharePoint, and RDS, validate application functionality after patching and review logs for signs of exploitation before the update was applied.
Why the patch count should not cause panic
A record-breaking CVE count can make Patch Tuesday feel unmanageable, but it should not lead to random patching or alert fatigue. Large vendors are increasingly clearing deep vulnerability backlogs and receiving more AI-assisted vulnerability submissions. That can inflate monthly counts without meaning every flaw is equally exploitable in every environment.
The better metric is exposure plus exploitability plus business impact. If a vulnerability is known exploited, reachable, or present on a high-value system, it moves to the front of the queue. If it affects software not deployed in the organization, it should be documented and closed out rather than consuming emergency response time.
Security teams should use this month’s release as a test of their prioritization process. The organizations that respond best will not be the ones that read all 974 entries manually; they will be the ones that quickly map the patch set to real assets, isolate the exploited flaws, and reduce risk on the systems attackers are most likely to target.
Source: The Hacker News source