As reported by BleepingComputer, Microsoft's September 2026 Patch Tuesday is the largest security update in the company's history, addressing a record-breaking 966 vulnerabilities — including two zero-days confirmed as actively exploited in the wild. The scale alone is notable, but the threat profile is what demands defender attention: both zero-days are local elevation-of-privilege (EoP) flaws, the exact class adversaries use to convert low-privilege footholds into full SYSTEM compromise.

Security Impact: As reported by BleepingComputer, Microsoft's September 2026 Patch Tuesday is the largest security update in the company's history, addressing a record-breaking 966 vulnerabilities — including two zero-days confirmed as actively exploited in the wild.

Why This Patch Tuesday Matters

The headline number — 966 — is staggering compared to the 570 flaws patched in July and 400 in August. BleepingComputer attributes the increase to Microsoft's adoption of an AI-powered vulnerability discovery system, which is surfacing more defects faster. While this is a net positive for long-term security posture, it also creates a workload shock for patch-management teams already stretched thin. Security leaders should expect this volume to persist as the discovery pipeline matures.

Of the 966 flaws, 105 are rated Critical, with 81 of those being Remote Code Execution (RCE) issues — the category most likely to enable wormable or externally exploitable attack paths. The two actively exploited zero-days, however, are Elevation of Privilege vulnerabilities, which means attackers already have initial access and are using these bugs to entrench and escalate. That distinction matters for prioritization.

The Two Actively Exploited Zero-Days

CVEComponentTypeSeverityExploited in WildPatch Available
CVE-2026-81963Windows Update StackElevation of Privilege (link following)Important / HighYesYes — Sept 2026 Patch Tuesday
CVE-2026-85880Windows Advanced Local Procedure Call (ALPC)Elevation of PrivilegeImportant / HighYesYes — Sept 2026 Patch Tuesday

Elevation-of-privilege zero-days are the workhorse of post-compromise activity. An attacker with a user-level foothold — whether via phishing, drive-by, or initial access broker payload — leverages these flaws to reach SYSTEM, disable defenders, and prepare for persistence or lateral movement.

CVE-2026-81963 is particularly concerning because it resides in the Windows Update Stack itself. Compromise of update-related components can enable attackers to tamper with patching workflows or manipulate update-related binaries, potentially turning the remediation mechanism against the organization. Microsoft credits Romain Deperne and MSTIC for the report but has not yet disclosed attack-pattern details.

CVE-2026-85880 targets the ALPC subsystem, a long-standing favorite for privilege escalation. ALPC has historically been a fertile ground for similar EoP chains, and defenders should assume adversaries will combine this with other vulnerabilities to bypass User Account Control and kernel-level mitigations.

Who Is Most Exposed

Who Is Most Exposed
Multi-tenant and shared endpoint environments — EoP flaws have outsized impact where non-admin users share systems.
VDI and RDS deployments — a single compromised session can escalate to host-wide SYSTEM.
Privileged workstations — admin tier endpoints compromised via EoP can breach Active Directory and the broader identity plane.
Unmanaged / consumer-grade Windows devices in hybrid environments, where patch latency is highest.

Shield53 Recommendations

Immediate Actions:

  • Patch the two zero-days first. Prioritize CVE-2026-81963 and CVE-2026-85880 across all Windows endpoints and servers. Do not delay for regression testing beyond a basic smoke test — active exploitation erodes the value of caution.
  • Hunt for exploitation indicators. Review local security event logs for unexpected SYSTEM-spawned processes, suspicious parent-child relationships involving wuauclt.exe, TrustedInstaller.exe, or ALPC port manipulation. Look for new services or scheduled tasks created by non-admin user SIDs.
  • Constrain ALPC and update-stack attack surface. Validate that User Account Control is enforced, that LocalAccountTokenFilterPolicy is not disabled, and that WDAC / AppLocker policies prevent arbitrary binary execution from user-writable directories.
  • Triage the 105 Critical RCEs by exposure. Internet-facing or untrusted-network-facing Windows hosts should receive these patches in the first wave. Internal-only assets can follow normal change windows.
  • Review the 204 pre-month flaws. BleepingComputer notes these were fixed earlier in the month across Azure AI, Cosmos DB, Entra ID, Copilot Studio, and other services. Confirm your cloud and SaaS tenants received these auto-patches and verify configuration drift.
  • Update EDR detections for behavior consistent with EoP chaining: unusual token manipulation, privilege attribute adjustments, and calls to NtSetInformationProcess targeting process tokens.

The trend is clear — vulnerability volume is climbing and AI-assisted discovery will only accelerate it. Security programs that still rely on monthly, monolithic patch cycles are structurally outmatched. Shift toward risk-based, continuous remediation: prioritize by exploitability and asset exposure, not by numerical position on the CVE list.