Microsoft's Record-Breaking Patch Tuesday Exposes 999 Vulnerabilities

Microsoft's September Patch Tuesday revealed a staggering 999 vulnerabilities, including 974 own-product vulnerabilities and 25 non-Microsoft CVEs. This is by far the most CVEs that Microsoft has ever published in a single day.

The largest number of vulnerabilities, 723, were found in Windows. Two of these vulnerabilities are being actively exploited in the wild: CVE-2026-85880, an elevation of privilege vulnerability in the Windows Advanced Local Procedure Call (ALPC) mechanism, and CVE-2026-81963, an elevation of privilege vulnerability in the Windows Update Stack.

Microsoft's ongoing efforts to improve memory safety by rewriting critical kernel components in Rust seem to be paying off, as neither Server 2025 nor Windows 11 received patches for CVE-2026-85880. However, Microsoft is aware that attackers are exploiting this vulnerability in the wild already.