Microsoft's September 2026 Patch Tuesday fixed 974 CVEs, including two exploited zero-days

Microsoft's September 2026 Patch Tuesday fixed 974 CVEs across Windows and related products, a record-setting monthly count that, according to a dev.to analysis, includes two vulnerabilities already exploited in the wild. Coverage cited by the analysis, including FreeBuf and a Huawei Cloud advisory, dates the release to 9 September 2026, turning an already enormous patch queue into an urgent prioritisation exercise for security teams.

What shipped in September

The dev.to article, which synthesises Microsoft's MSRC release notes with the FreeBuf and Huawei Cloud summaries, breaks the 974 fixes into 438 elevation-of-privilege issues, 257 remote code execution issues and 20 vulnerabilities in the wormable class. The release also contains a Critical-rated Exchange remote code execution flaw that can be triggered through a Visio file sent over email, a delivery path that matters most on Exchange OWA instances reachable from the internet.

The two exploited zero-days

The release lists two zero-days under active exploitation: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in ALPC. Both are local privilege escalation bugs. That detail shapes triage. These are not entry points an outsider uses to break into a network; they are tools for consolidating access once a foothold already exists, after a malware infection or account compromise, for instance. They still need fast patching, but they pose a very different kind of risk from an unpatched, internet-facing RCE.

Joining patch state with external exposure

The article's central argument is that teams tend to treat the monthly release as nothing more than a backlog of internal fixes, when internet-wide asset mapping can offer a complementary view from the outside. It proposes three queries to turn the patch queue into an exposure-ranked one:

• Enumerate external RDP and remote-access services per organisation or ASN, so triage of the exploited zero-days sits alongside exposure triage of the remote-facing services where attackers typically establish an RCE foothold.
• Track Exchange OWA and other webmail surfaces separately, since web-reachable instances are the population where the Visio-over-email route becomes exploitable.
• Re-scan external banners and service versions after deployment to verify that the visible footprint has actually shrunk, as a cross-check on internal compliance reports.

The author points to ZoomEye as an example of a mapping platform that supports these query patterns through fingerprints of products, services and versions.

What mapping cannot see

The piece is candid about the limits of an outside-in view. External fingerprinting cannot see patch levels on hosts behind firewalls, and version banners often lag the real build in cloud and containerised deployments. Local privilege escalations, including both of September's zero-days, are invisible from outside altogether and require internal inventory instead. The proposed division of responsibilities is straightforward: patch status is internal tooling's job, internet-visible exposure is mapping's job, and priorities emerge from combining the two datasets. The author also discloses that no live mapping queries were run for the article itself, because the query channel was unavailable at writing time, and that counts and CVE identifiers come from the cited advisories.

Why it matters

A release of this size cannot be patched in a single pass; it has to be triaged. The September numbers give practitioners a concrete prioritisation rule: weigh internal patch state against external exposure. Internet-reachable systems running affected remote-access components, or web-facing Exchange front ends, carry materially more risk than identically unpatched internal workstations, because the RCE and wormable-class flaws map directly onto that exposure. The two exploited zero-days invert the picture: they are post-compromise bugs best addressed through fast patching plus internal monitoring. Record-sized Patch Tuesdays appear likely to recur, and the durable lesson from this one is the workflow. Join internal inventory with an external view, and a backlog becomes a ranked queue rather than a wall of 974 line items.