Microsoft’s September 2026 Patch Tuesday fixed a record number of vulnerabilities, close to 974, including two actively exploited Windows zero-days: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows ALPC. Both let a local attacker gain SYSTEM privileges. Patch the two exploited zero-days first, then work through the critical fixes.
What happened
September 2026 brought a record-breaking Patch Tuesday. Microsoft addressed close to 974 vulnerabilities across its software portfolio, the largest single Patch Tuesday on record. Buried in that enormous volume were the two that matter most: a pair of Windows zero-days that attackers are already exploiting in the wild.
A patch load of this size is a challenge in itself. The instinct to work through it in order, or by severity score, is understandable but wrong. When some flaws are being actively exploited, they need to jump the queue, regardless of how many other fixes are competing for attention. The number is a distraction. The exploitation status is what should drive your response.
The two exploited zero-days
The two actively exploited flaws are both Windows privilege escalation vulnerabilities that let a local attacker gain SYSTEM, the highest level of access on a Windows machine.
The first, CVE-2026-81963, is an improper link resolution issue in the Windows Update Stack. The second, CVE-2026-85880, is a flaw in the Windows Advanced Local Procedure Call, or ALPC, subsystem. Both were confirmed as exploited in attacks to gain SYSTEM privileges, and both have been added to the CISA Known Exploited Vulnerabilities catalogue with a short remediation deadline for federal agencies. Microsoft has not detailed exactly how they were exploited, which is common with active zero-days.
These two are your first priority this month, ahead of everything else in the release.
Why privilege escalation flaws matter
It is tempting to downgrade a privilege escalation flaw because it needs local access first. That reasoning is exactly why these flaws are so useful to attackers, and why treating them as low priority is a mistake.
A privilege escalation vulnerability is almost never the way in. It is the second step. An attacker gains an initial foothold through a phishing email, a stolen credential or another flaw, lands as a low-privileged user, and then uses a bug like these to become SYSTEM. From there they can disable defences, move laterally and establish persistence. In other words, these zero-days are the part of an attack chain that turns a minor compromise into a full one. That is why they are being exploited, and why they come first.
How to prioritise a record patch load
Nearly a thousand fixes is overwhelming if you try to treat them all equally. A simple, risk-based order keeps you focused:
- Patch the confirmed exploited zero-days first, always, regardless of their severity score
- Then patch critical remote code execution flaws on internet-facing systems
- Then privilege escalation and lateral-movement flaws on servers and endpoints
- Then everything else on your normal cadence
The record number of CVEs does not change this order. It just makes disciplined prioritisation more important, because the temptation to drown in the volume is greater. Focus on exploitation status and exposure, not the raw count.
Why patch governance matters at this scale
A Patch Tuesday of this size is a reminder that patching is not a task, it is a governed process. Organisations that handle large patch loads well have a clear way to identify what matters most, deploy it quickly, and confirm it applied, without being paralysed by the volume. Those without that process either patch slowly, leaving exploited flaws open, or patch indiscriminately and exhaust their teams.
Getting patch governance right, deciding what to prioritise, who owns it, and how to verify it, is what turns a record patch load from a crisis into a routine. It is also exactly the kind of capability that benefits from experienced security leadership.
Why monitoring belongs alongside patching
Even with good prioritisation, patching a record release takes time, and attackers exploiting these zero-days have a head start. That gap is where monitoring earns its place. If an attacker is using one of these privilege escalation flaws, the behaviour it produces, unexpected SYSTEM-level activity, unusual process behaviour, lateral movement, can be detected even while patching is under way. Prevention and detection together keep a fast-moving zero-day from becoming an incident.
If you want help prioritising this month’s patches, governing the process, or watching for exploitation in the meantime, our virtual CISO services can build the patch governance, and our managed detection and response watches for the behaviour these flaws produce.
For the official details, confirm against the Microsoft Security Update Guide and the CISA Known Exploited Vulnerabilities catalogue.
Frequently asked questions
What were the September 2026 Patch Tuesday zero-days?
Two actively exploited Windows privilege escalation flaws: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows ALPC. Both allow a local attacker to gain SYSTEM privileges and were added to the CISA Known Exploited Vulnerabilities catalogue.
How many CVEs did it fix?
Close to 974, making it the largest single Patch Tuesday on record. The volume is a challenge, but the two actively exploited zero-days are what should be patched first, regardless of the overall count.
Why do privilege escalation flaws matter?
They turn a small foothold into full control. Attackers rarely start with them; after gaining initial access, they use a privilege escalation flaw to become SYSTEM, disable defences and move deeper. That makes these zero-days a critical link in the attack chain.
How should we prioritise such a large patch set?
Patch the confirmed exploited zero-days first, then critical remote code execution on internet-facing systems, then privilege escalation on servers and endpoints, then the rest on your normal cadence. Let exploitation status and exposure drive the order, not the raw CVE count.
