[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEylIPS1ogVPwEPVOnVPcejRdWowGSzrzRHk6lvEdBH4":3},{"article":4,"iocs":49,"watch_terms":75,"solutions":76,"lesson":167},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"e4fb5699-48f4-434c-890e-9639458a2c45","Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days","microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days-9d5b32","The record-breaking September security update fixes two exploited privilege-escalation zero-days and 20 potentially wormable vulnerabilities. The post Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days appeared first on SecurityWeek.","Microsoft's September Patch Tuesday addresses a record-breaking 974 vulnerabilities, including two zero-days that were actively exploited. One zero-day, CVE-2026-85880, is a heap buffer overflow in Windows ALPC allowing privilege escalation, and the other, CVE-2026-81963, is an update stack flaw also enabling privilege escalation. The update also includes fixes for 20 potentially wormable vulnerabilities.","Microsoft patches 974 vulnerabilities, including two zero-days exploited in the wild.","https:\u002F\u002Fwww.securityweek.com\u002Fmicrosoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F12\u002FMicrosoft-Security-leaders.jpg","2026-09-08T19:20:06+00:00","2026-09-08T20:00:37.645244+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Windows","product",{"name":24,"type":22},"Exchange Server",{"name":26,"type":22},"SharePoint Server",{"name":28,"type":22},"SQL Server",{"name":30,"type":22},"Remote Desktop Services","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54,57,60,63,66,69,72],{"type":51,"value":52,"context":53},"cve","CVE-2026-85880","Exploited zero-day heap buffer overflow in Windows ALPC",{"type":51,"value":55,"context":56},"CVE-2023-21674","Previous ALPC zero-day vulnerability",{"type":51,"value":58,"context":59},"CVE-2026-81963","Exploited zero-day improper link resolution in Windows Update Stack",{"type":51,"value":61,"context":62},"CVE-2026-55007","Remote code execution in Exchange Server",{"type":51,"value":64,"context":65},"CVE-2026-80097","Elevation of privilege in Authenticator",{"type":51,"value":67,"context":68},"CVE-2026-69465","Remote code execution in SharePoint Server",{"type":51,"value":70,"context":71},"CVE-2026-65669","Elevation of privilege in SQL Server",{"type":51,"value":73,"context":74},"CVE-2026-69525","Remote code execution in Remote Desktop Services",[18,21,24],{"controls":77,"vendors":161},[78,107,132],{"slug":79,"name":80,"problem":81,"products":82},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":108,"name":109,"problem":110,"products":111},"patch-management","Automated patch management","Known holes get closed in days, not months.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":108,"product_name":129,"url":130,"description":131},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":133,"name":134,"problem":135,"products":136},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[137,145,153],{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[162],{"slug":163,"name":18,"logo_path":164,"roles":165},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[166],"affected",{"slug":168,"title":169,"body":170,"framework_refs":171,"framework_notes":180},"record-974-microsoft-vulnerabilities-patched-including-two-actively-exploited-zero-days","Record 974 Microsoft Vulnerabilities Patched, Including Two Actively Exploited Zero-Days","Microsoft's September Patch Tuesday addressed a staggering 974 vulnerabilities, setting a new record and highlighting the growing complexity of managing software security at scale. Two zero-day vulnerabilities — a heap buffer overflow in Windows ALPC (CVE-2026-85880) and an update stack flaw (CVE-2026-81963) — were actively exploited in the wild before patches were available, meaning attackers had a window to escalate privileges on unpatched systems. Additionally, 20 potentially wormable vulnerabilities were included, raising the risk of rapid lateral movement across networks if left unpatched. This underscores that even well-resourced vendors face an ever-expanding attack surface, and organizations that delay patching expose themselves to both opportunistic and targeted attacks.",[172,173,174,175,176,177,178,179],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SI-2: Flaw Remediation","NIST SI-5: Security Alerts, Advisories, and Directives","NIST RA-5: Vulnerability Monitoring and Scanning","ITIL Change Management: Emergency Change Procedures","CISA KEV (Known Exploited Vulnerabilities) Catalog: Prioritization Guidance",{}]