Microsoft's September 2026 Patch Tuesday addresses a record 974 CVEs, including two exploited zero-days enabling local privilege escalation: CVE-2026-85880, a heap buffer overflow in Windows Advanced Local Procedure Call (ALPC), and CVE-2026-81963, an improper link resolution vulnerability in the Windows Update Stack. The ALPC flaw allows a low-privilege AppContainer attacker to escape sandbox restrictions and gain System privileges without user interaction. The Update Stack zero-day similarly permits local privilege escalation. The update also fixes 20 potentially wormable vulnerabilities that allow remote code execution without authentication or user interaction. Other notable patches cover Exchange Server, Office, SQL Server, SharePoint, Azure, and Remote Desktop Services. Critical Servicing Stack Updates were released for Windows Server 2012, 2012 R2, and Windows 10 Version 1607/Server 2016. Microsoft and security experts advise organizations to prioritize patching based on exposure and risk relevance.

The vulnerabilities fixed include two actively exploited zero-days that allow local attackers to elevate privileges to System level, potentially bypassing sandbox protections. The presence of 20 wormable vulnerabilities means some flaws could be exploited remotely without authentication or user interaction, increasing the risk of widespread malware propagation. The broad scope of patched products (Windows, Office, Exchange, SQL Server, SharePoint, Azure, etc.) means many enterprise environments could be affected if unpatched. However, Microsoft notes that while the number of patched vulnerabilities is large, the subset relevant and exploitable in most organizations is smaller. The critical Servicing Stack Updates improve the reliability and security of Windows update processes.

Microsoft has released official patches addressing all 974 vulnerabilities, including the two exploited zero-days and the wormable flaws. Organizations should apply the September 2026 security updates promptly, prioritizing systems exposed to local user access or remote attack vectors. The Servicing Stack Updates for Windows Server 2012, 2012 R2, and Windows 10 Version 1607/Server 2016 should also be applied to ensure update reliability and security. Security teams are advised to assess which vulnerabilities are relevant to their environment and prioritize remediation accordingly. No additional vendor advisories indicate that no action is required; thus, patching is the recommended mitigation.