Microsoft’s 974-CVE update puts two exploited Windows flaws first
Microsoft released its September 2026 security updates on 8 September, covering 974 Microsoft CVEs. Two High-severity Windows vulnerabilities in the release, CVE-2026-85880 and CVE-2026-81963, allow local privilege escalation and were already under exploitation according to Microsoft. Patches are available for both.
The size of the release creates a substantial testing and deployment task across Microsoft environments, but the vulnerabilities do not present equal risk to every organisation. The two exploited flaws affect different Windows generations and can allow an attacker with an authorised local foothold to obtain SYSTEM-level privileges.
Microsoft’s official count is 974 CVEs
Microsoft’s release note identifies 974 CVEs covering its own products. The company separately republished 25 non-Microsoft CVEs, bringing the combined number of entries to 999 only when both groups are counted.
That distinction matters when describing the scope of the release. The figure of 999 does not mean Microsoft fixed 999 vulnerabilities in its own products. For deployment planning, security teams should use the applicable Microsoft advisories and product-specific packages rather than treating the combined entry count as a uniform patch total.
ALPC flaw affects older Windows branches
CVE-2026-85880 is a heap-based buffer overflow and use-of-uninitialised-resource issue in Windows Advanced Local Procedure Call, or ALPC. Microsoft classifies it as a High-severity local elevation-of-privilege vulnerability with a CVSS v3.1 score of 7.8. Successful exploitation can elevate an authorised local attacker to SYSTEM privileges.
The affected ranges include Windows 10 Version 1607 and Windows Server 2016 from build 10.0.14393.0 to before fixed build 10.0.14393.9512. Windows 10 Version 1809 and Windows Server 2019 are affected from 10.0.17763.0 to before 10.0.17763.9245. The boundaries are 10.0.19044.0 to before 10.0.19044.7725 for Windows 10 Version 21H2, 10.0.19045.0 to before 10.0.19045.7725 for Windows 10 Version 22H2, and 10.0.20348.0 to before 10.0.20348.5622 for Windows Server 2022.
Windows Server 2012 is affected from build 6.2.9200.0 to before 6.2.9200.26349, while the Server 2012 R2 range begins at 6.3.9600.0 and ends before 6.3.9600.23397. Microsoft’s record includes Server Core where listed. Products absent from the record should not be assumed to have been independently verified as unaffected.
Update Stack weakness reaches newer systems
CVE-2026-81963 affects a separate group of Windows releases. It stems from improper link resolution before file access and improper access control in the Windows Update Stack. The flaw also permits local privilege escalation and carries a High severity rating with a CVSS v3.1 score of 7.8.
Microsoft’s CNA data lists Windows 11 Version 23H2 from build 10.0.22631.0 to before fixed build 10.0.22631.7582. Windows 11 Version 24H2 is affected from 10.0.26100.0 to before 10.0.26100.9445, while Version 25H2 runs from 10.0.26200.0 to before 10.0.26200.9445. The Version 26H1 range starts at 10.0.28000.0 and ends before 10.0.28000.2954.
For Windows Server 2025 and Server Core, the listed range begins at 10.0.26100.0 and ends before fixed build 10.0.26100.33438. These separate branch groups make accurate asset inventory important. Treating every Windows system as one deployment group could leave older servers exposed to the ALPC flaw or newer Windows 11 and Server 2025 systems exposed through the Update Stack.
Exploitation is confirmed, but details are limited
Microsoft’s Security Response Center reported exploitation of both vulnerabilities. CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 8 September, confirming their exploitation status and providing a strong remediation signal. CISA’s catalogue requirements apply to United States federal civilian agencies, although other defenders can use the entries to inform risk-based priorities.
No threat actor, campaign, victim organisation, targeted sector or geographic scope has been publicly identified. There is also no public evidence establishing data access, exfiltration, persistence, operational disruption or other realised consequences. No public proof-of-concept was found by the evidence cutoff, but that status remains separate from the confirmed exploitation recorded by Microsoft and CISA.
The release extends beyond Windows
Windows accounts for 723 vulnerabilities in Microsoft’s product table. The release also lists 111 Office vulnerabilities, 62 affecting SQL, 22 in Developer Tools, 16 in SharePoint Server, 12 in Azure, 10 in Skype for Business, nine in Exchange Server and nine in the Other category. These category figures form Microsoft’s product table and should not be added to produce a separate overall total.
The breadth of affected product families leaves enterprises with a deployment workload extending beyond Windows endpoints. Exact affected versions vary by CVE, and the remaining September vulnerabilities have product-specific fixes rather than one common fixed version. Security teams need to identify applicable products and branches, consult Microsoft’s deployment information and test the relevant update packages before wider rollout.
Risk-based remediation should put CVE-2026-85880 and CVE-2026-81963 first on high-value or potentially compromised systems because active exploitation is established. The branch differences also make it important to verify deployed builds against the fixed boundaries rather than assuming one Windows update status covers every affected generation.
Australian organisations running the listed Microsoft products face the same technical exposure because the advisories contain no geographic limitation. No Australian targeting, victims or exploitation have been established, and CISA’s federal requirements should not be interpreted as an Australian mandate.
The September release is separate from Microsoft’s August 2026 Patch Tuesday release and CVE-2026-68820, previously covered by The Hack Academy. With no authoritative temporary mitigation identified for either highlighted September flaw, remediation depends on deploying the applicable Microsoft updates and confirming that affected systems have reached the relevant fixed builds.
Fixed-build boundaries are useful only when defenders can map them to the software branches actually deployed across an organisation. Explore The Hack Academy’s online cybersecurity training programme to study cybersecurity fundamentals through self-paced learning and practical exercises alongside theory.
