Microsoft Fixes Record 964 Flaws on Patch Tuesday, Including Two Actively Exploited Zero-Days

PUBLISHED Sep 9, 2026, 11:00 AM ET

Microsoft released its largest security update on record for September 2026, addressing 964 vulnerabilities across enterprise software and core Windows components. The massive rollout includes 104 critical flaws and 860 important issues affecting products such as Exchange Server, SharePoint, SQL Server, and Microsoft Office. Most notably, the update patches two actively exploited zero-day vulnerabilities tracked as CVE-2026-81963 and CVE-2026-85880. Both carry a CVSS severity score of 7.8 out of 10 and allow local attackers who already possess device access to elevate privileges to SYSTEM level. The first flaw involves improper link resolution within the Windows Update Stack, while the second is a heap-based buffer overflow in the Advanced Local Procedure Call messaging system enabling sandbox escapes. Security agencies urge immediate administrator deployment. The release coincides with heightened cybersecurity alerts regarding industrial model distillation by foreign actors.

By Sarah Whitman | JQJO News

Media Bias

Articles Published:: 25
Right Leaning:: 0
Left Leaning:: 0
Neutral:: 25

Explain Framing

Left: Highlighted systemic corporate software quality failures and regulatory oversight needs. Center: Reported factual technical details regarding vulnerability counts and zero day specifics. Right: Emphasized national security implications and threats from foreign adversarial actors.