Story perspectives

Microsoft patches 974 CVEs, including two exploited zero-days

9/9/2026

Summary

Story summary

Microsoft released a record-breaking 2026 Patch Tuesday fixing 974 CVEs, including two exploited zero-days.
Exploited flaws are CVE-2026-81963 in Windows Update Stack and CVE-2026-85880 in Windows ALPC.
CISA added the two flaws to its KEV catalog, mandating fixes by September 22, 2026.
Tenable’s Satnam Narang said batch is 70% larger than July’s, raising totals above 2,600.
Experts warned organizations should prioritize exploited zero-days and reachable remote-code paths over CVE counts.

History

Historical Context

In early 2005, Windows Update served roughly 150 million users, with 90 % using automatic updates, establishing a massive distribution channel for Microsoft’s monthly Patch Tuesdays. That infrastructure enabled the October 14 2008 release of over 1,000 patches to address the Conficker-exploited MS08-067 flaw, and the 2026 release of 974 CVEs, prompting agencies such as DHS and CISA to prioritize critical fixes.

1 of 2

Story summary

Microsoft released a record-breaking 2026 Patch Tuesday fixing 974 CVEs, including two exploited zero-days.
Exploited flaws are CVE-2026-81963 in Windows Update Stack and CVE-2026-85880 in Windows ALPC.
CISA added the two flaws to its KEV catalog, mandating fixes by September 22, 2026.
Tenable’s Satnam Narang said batch is 70% larger than July’s, raising totals above 2,600.
Experts warned organizations should prioritize exploited zero-days and reachable remote-code paths over CVE counts.

1 / 2