Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days

Microsoft released its largest monthly security update ever, remediating 974 vulnerabilities across its ecosystem. Among these fixes are two Windows zero-day flaws, CVE-2026-85880 and CVE-2026-81963, that have been actively exploited in the wild.

Both vulnerabilities enable local privilege escalation with a CVSS score of 7.8, allowing attackers to gain SYSTEM privileges. The issue was reported by Volexity, Proofpoint, and Microsoft MSTIC, prompting CISA to add both CVEs to the Known Exploited Vulnerabilities catalog. Organizations should apply the September 2026 patches immediately to secure their systems.