INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Microsoft patches 974 security holes in Windows and other software

| 2026-09-08 21:26 CRITICAL HIGH INDUSTRY & POLICY
JSON
Executive Summary
AI-generated
Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and deploying so many fixes each month. This month’s patch bundle obliterates the software giant’s previous record set in July , when it released updates for at least 570 security vulnerabilities.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-81963, CVE-2026-85880 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Technical Observables 1 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
domains 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-78510CVE-2026-78510 CVE-2026-69595CVE-2026-69595 CVE-2026-69380CVE-2026-69380 CVE-2026-85880CVE-2026-85880 CVE-2020-1350CVE-2020-1350 CVE-2026-69730CVE-2026-69730 CVE-2026-81963CVE-2026-81963 CVE-2026-69829CVE-2026-69829
Target & Sectors
Global Scope
Incident Timeline
‎2026/09/08
Attackers are actively exploiting two zero-day vulnerabilities, CVE-2026-85880 and CVE-2026-81963, which allow an attacker to elevate their privileges on Windows systems.
infrastructure Windows
Among the more serious critical flaws this month is CVE-2026-69730 , a DNS weakness present in Windows Server 2012 onward and on Windows 10.
Windows accounted for most of the vulnerabilities, with 723, followed by Office and Office 2016, with 111 each.
The two zero-day vulnerabilities that attackers are actively exploiting, and hence need priority attention, are CVE-2026-85880 (CVSS: 7.8), an elevation of privilege bug in Windows Advanced Local Procedure Call (ALPC), and CVE-2026-81963 (CVSS 7.8), another EoP flaw this time in Windows Update Stack.
organisation Trend Micro's
Dustin Childs, head of threat awareness at Trend Micro's Zero Day Initiative, pointed to CVE-2026-69380 (CVSS:8.1), a Microsoft Exchange Server EoP, as another vulnerability that organizations should patch immediately, because it "allows low-privileged attackers to impersonate any user and hijack every mailbox in the organization.
organisation Microsoft Exchange
Dustin Childs, head of threat awareness at Trend Micro's Zero Day Initiative, pointed to CVE-2026-69380 (CVSS:8.1), a Microsoft Exchange Server EoP, as another vulnerability that organizations should patch immediately, because it "allows low-privileged attackers to impersonate any user and hijack every mailbox in the organization.
organisation Office and Office 2016
Windows accounted for most of the vulnerabilities, with 723, followed by Office and Office 2016, with 111 each.
infrastructure 7.8
The two zero-day vulnerabilities that attackers are actively exploiting, and hence need priority attention, are CVE-2026-85880 (CVSS: 7.8), an elevation of privilege bug in Windows Advanced Local Procedure Call (ALPC), and CVE-2026-81963 (CVSS 7.8), another EoP flaw this time in Windows Update Stack.
organisation Windows Advanced Local Procedure Call
The two zero-day vulnerabilities that attackers are actively exploiting, and hence need priority attention, are CVE-2026-85880 (CVSS: 7.8), an elevation of privilege bug in Windows Advanced Local Procedure Call (ALPC), and CVE-2026-81963 (CVSS 7.8), another EoP flaw this time in Windows Update Stack.
organisation SigRed
The "zero-click RCE bugs — headlined by a Windows DNS Server flaw ( CVE-2026-69730 CVSS:9.8) acting as SigRed’s spiritual successor — creates severe, self-propagating contagion risk across enterprise networks," he wrote.
infrastructure 9.8
" Critical RCE Flaws Researchers from Action1 highlighted three near-maximum severity (CVSS: 9.8) RCE bugs that organizations would do well to prioritize from this month's massive set: CVE-2026-69829 , an RCE in Windows Shell; CVE-2026-69595 , an RCE in Windows Services for NFS ONCRPC XDR Driver; and CVE-2026-78510 , a Microsoft Word RCE.
organisation NFS
" Critical RCE Flaws Researchers from Action1 highlighted three near-maximum severity (CVSS: 9.8) RCE bugs that organizations would do well to prioritize from this month's massive set: CVE-2026-69829 , an RCE in Windows Shell; CVE-2026-69595 , an RCE in Windows Services for NFS ONCRPC XDR Driver; and CVE-2026-78510 , a Microsoft Word RCE.
organisation Cohesity
Amol Sarwate, head of security research and REDLab at Cohesity, advised organizations to prioritize vulnerabilities in the Windows identity and infrastructure plane this month.
organisation RCE
Another 25%, or 260, were remote code execution (RCE) flaws, while about 18%, or 175, involved information disclosure.
organisation DNS
SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE SigRed ( CVE-2020-1350 ) was a maximum severity RCE flaw in DNS servers from 2020 that allowed an unauthenticated attacker to gain Local System/Domain Administrator-level control and potentially spread across a network without user interaction.
organisation Local System/Domain Administrator
SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE SigRed ( CVE-2020-1350 ) was a maximum severity RCE flaw in DNS servers from 2020 that allowed an unauthenticated attacker to gain Local System/Domain Administrator-level control and potentially spread across a network without user interaction.
organisation Microsoft
Microsoft released fixes for 974 unique vulnerabilities in its scheduled security update for September, which until recently would have represented a full year’s worth of CVEs.
organisation September Patch
" A Cluster of Wormable CVEs Also of high priority in Microsoft's September Patch Tuesday are a cluster of 20 wormable CVEs, Childs warned in an emailed statement.
organisation DHCP
Attackers could exploit these flaws by sending unauthenticated packets to DNS, DHCP, RDS, and Netlogon listeners on domain controllers and Microsoft Exchange, he said in a statement.
organisation RDS
Attackers could exploit these flaws by sending unauthenticated packets to DNS, DHCP, RDS, and Netlogon listeners on domain controllers and Microsoft Exchange, he said in a statement.
organisation Netlogon
Attackers could exploit these flaws by sending unauthenticated packets to DNS, DHCP, RDS, and Netlogon listeners on domain controllers and Microsoft Exchange, he said in a statement.
organisation Office
Related: Critical Langflow Vulnerability Exploited as Attacks on AI Platform Rise "On the endpoint front, security teams should prioritize the Office stack, as attackers can exploit a condition in the SMB client and create a malicious Word RTF or a malicious message in the Outlook Reading Pane that can lead to code execution," he cautioned.
organisation SMB
Related: Critical Langflow Vulnerability Exploited as Attacks on AI Platform Rise "On the endpoint front, security teams should prioritize the Office stack, as attackers can exploit a condition in the SMB client and create a malicious Word RTF or a malicious message in the Outlook Reading Pane that can lead to code execution," he cautioned.
organisation Narang
" Security teams should focus on understanding the vulnerabilities that actually apply to their organizations, figure out if the flaws are reachable and exploitable in their specific environments, and prioritize based on risk context, Narang said.
organisation Tyler Reguly
It's also important to keep in mind that the massive surge in vulnerability discovery and disclosure is likely temporary, noted Tyler Reguly, associate director of security R&D at Fortra, in a statement.
organisation Fortra
It's also important to keep in mind that the massive surge in vulnerability discovery and disclosure is likely temporary, noted Tyler Reguly, associate director of security R&D at Fortra, in a statement.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
Windows accounted for most of the vulnerabilities, with 723, followed by Office and Office 2016, with 111 each.
The two zero-day vulnerabilities that attackers are actively exploiting, and hence need priority attention, are CVE-2026-85880 (CVSS: 7.8), an elevation of privilege bug in Windows Advanced Local Procedure Call (ALPC), and CVE-2026-81963 (CVSS 7.8), another EoP flaw this time in Windows Update Stack.
The "zero-click RCE bugs — headlined by a Windows DNS Server flaw ( CVE-2026-69730 CVSS:9.8) acting as SigRed’s spiritual successor — creates severe, self-propagating contagion risk across enterprise networks," he wrote.
" Critical RCE Flaws Researchers from Action1 highlighted three near-maximum severity (CVSS: 9.8) RCE bugs that organizations would do well to prioritize from this month's massive set: CVE-2026-69829 , an RCE in Windows Shell; CVE-2026-69595 , an RCE in Windows Services for NFS ONCRPC XDR Driver; and CVE-2026-78510 , a Microsoft Word RCE.
Amol Sarwate, head of security research and REDLab at Cohesity, advised organizations to prioritize vulnerabilities in the Windows identity and infrastructure plane this month.
Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever.
There are two “zero-day” flaws fixed this month that are being actively exploited: both CVE-2026-81963 and CVE-2026-85880 allow an attacker to elevate their privileges on Windows system.
Fully 113 of the bugs addressed today earned Microsoft’s “critical” rating, meaning they could be abused by malware or miscreants to seize control over a vulnerable Windows machine with little or no help from the user.
Among the more serious critical flaws this month is CVE-2026-69730 , a DNS weakness present in Windows Server 2012 onward and on Windows 10.
Also scary is CVE-2026-69829 , a critical, remote code execution flaw in the Windows Shell.
Tyler Reguly , associate director of security research and development at Fortra , said one core challenge with deploying Windows updates is that they need to be tested before being installed across an organization because not all third-party soft…
…e a threat by being reachable and exploitable, and prioritize remediation based on this risk context.” Of course, regular Windows users don’t need to test patches before deploying them, but they still need to open Windows Update periodically or e…
And at the rate these Windows patch releases are ballooning in size, it’s probably best not to let them pile up month after month.
Enterprise Windows admins will want to keep an eye on askwoody.com for news of any updates that appear to be causing problems.
Metrics
infrastructure
‎7.8
Software Version
The two zero-day vulnerabilities that attackers are actively exploiting, and hence need priority attention, are CVE-2026-85880 (CVSS: 7.8), an elevation of privilege bug in Windows Advanced Local Procedure Call (ALPC), and CVE-2026-81963 (CVSS 7.8), another EoP flaw this time in Windows Update Stack.
Metrics
infrastructure
‎9.8
Software Version
" Critical RCE Flaws Researchers from Action1 highlighted three near-maximum severity (CVSS: 9.8) RCE bugs that organizations would do well to prioritize from this month's massive set: CVE-2026-69829 , an RCE in Windows Shell; CVE-2026-69595 , an RCE in Windows Services for NFS ONCRPC XDR Driver; and CVE-2026-78510 , a Microsoft Word RCE.
Intelligence Sources
Krebs On Security 2026-09-08
Dark Reading 2026-09-08