Microsoft’s September 2026 Patch Tuesday has landed as one of the largest single updates the company has ever shipped, resolving 973 vulnerabilities across its product line plus another 25 republished advisories for third-party CVEs affecting Microsoft software. Buried inside that enormous total are two vulnerabilities that Microsoft confirms are already being exploited in the wild — a reminder that raw patch counts and real-world risk don’t always move in lockstep.

Breaking Down a Record-Setting Release

Of the 973 flaws patched, elevation-of-privilege bugs make up the single largest category at 438, followed by 258 remote-code-execution vulnerabilities, 173 information-disclosure issues, 56 denial-of-service bugs, 19 security-feature bypasses, 16 spoofing flaws, and 13 tampering issues. By product, Windows itself absorbed the bulk of the fixes at 723, with Office trailing at 111, SQL Server at 62, developer tools at 22, SharePoint at 16, and Exchange at 9.

That sheer volume creates a real prioritization problem for security teams: with nearly a thousand advisories to sort through, it’s tempting to focus only on entries marked Critical and defer the rest. This month, that instinct would be a mistake.

Two Zero-Days Already Being Exploited

Neither of the two actively exploited vulnerabilities in this release carries Microsoft’s top “Critical” severity label — both are rated “Important” — which is precisely why security researchers are urging administrators not to rely on severity ratings alone when deciding what to patch first.

• CVE-2026-85880 is an elevation-of-privilege flaw in Windows’ Advanced Local Procedure Call (ALPC) mechanism. Microsoft confirms it is under active exploitation, giving attackers who already have a foothold on a machine a way to escalate to higher privileges.
• CVE-2026-81963 affects the Windows Update Stack and stems from improper link resolution before file access — a class of bug historically abused to redirect privileged file operations to attacker-controlled paths. Microsoft says private exploitation has been confirmed even though the flaw hasn’t been publicly disclosed in detail.

Both bugs are elevation-of-privilege issues rather than remote entry points, meaning they’re most dangerous as the second stage of an attack chain: useful to an intruder who has already gained initial access through phishing, a separate vulnerability, or stolen credentials, and now wants full control of the machine.

Critical Remote Code Execution Bugs to Watch

Beyond the two zero-days, several Critical-rated vulnerabilities deserve fast attention. CVE-2026-83939 affects the Windows Secure Kernel Mode, while CVE-2026-83498 and CVE-2026-83501 both touch Virtualization-Based Security enclaves — the hardware-backed isolation layer Windows relies on to protect credentials and sensitive processes from a compromised OS. On the productivity side, CVE-2026-81959 and CVE-2026-81953 are remote-code-execution flaws in Excel, and CVE-2026-81952 affects Word, all of which could be triggered through a malicious document.

Further down the list, administrators should also track CVE-2026-85877 in the Windows Print Spooler, CVE-2026-83997 in Windows Message Queuing, CVE-2026-83998 in the Remote Desktop Client, and CVE-2026-83948 in the Azure CLI — all rated Important for remote code execution and all historically popular targets once proof-of-concept exploit code begins circulating.

How to Approach a Release This Large

Security teams facing a patch batch of this size are better served by mapping advisories against their actual deployed systems than by assuming a bug is irrelevant because it isn’t labeled Critical. Recommended steps include:

• Prioritizing the two confirmed zero-days regardless of their “Important” rating, since active exploitation trumps CVSS score
• Rolling updates out through a representative pilot group before full deployment, using tools like Microsoft Intune update rings for staged rollouts
• Reviewing Microsoft’s published list of known issues for this release before approving changes in production
• Installing the latest servicing stack updates alongside the security patches themselves, and monitoring for failed installations afterward

With Windows accounting for nearly three-quarters of this month’s fixes and two flaws already weaponized, September’s release is a clear signal that patch cadence discipline matters as much as ever — regardless of how overwhelming the advisory list looks at first glance.