Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Microsoft's September Patch Tuesday addressed a staggering 974 vulnerabilities, setting a new record and highlighting the growing complexity of managing software security at scale. Two zero-day vulnerabilities — a heap buffer overflow in Windows ALPC (CVE-2026-85880) and an update stack flaw (CVE-2026-81963) — were actively exploited in the wild before patches were available, meaning attackers had a window to escalate privileges on unpatched systems. Additionally, 20 potentially wormable vulnerabilities were included, raising the risk of rapid lateral movement across networks if left unpatched. This underscores that even well-resourced vendors face an ever-expanding attack surface, and organizations that delay patching expose themselves to both opportunistic and targeted attacks.