Microsoft September 2026 Patch Tuesday: 964 CVEs, Including Two Zero-Day Exploits (CVE-2026-81963, CVE-2026-85880)

What Happened

On 2026‑09‑12 Microsoft issued a Patch Tuesday update that fixed 964 CVEs, the most ever in a single release. The update includes patches for two zero‑day vulnerabilities (CVE‑2026‑81963 and CVE‑2026‑85880) that were actively exploited in the wild.

Impact

All Windows, Office, Azure, and related Microsoft products are affected. The critical and important CVEs span user‑mode applications, kernel drivers, and cloud services, potentially allowing remote code execution, privilege escalation, or data exfiltration.

Affected Products

• .NET Framework and .NET Core
• ASP.NET Core
• Active Directory Domain Services, AD CS, AD FS
• Azure services: Azure Arc, Azure HDInsights, Azure CycleCloud, Azure Attestation, Azure CLI, Azure SDKs
• Microsoft Office suite (Word, Excel, PowerPoint, Outlook, Access, Publisher, SharePoint)
• Microsoft Teams, Visual Studio, Visual Studio Code, GitHub Copilot
• Windows kernel components: HID class driver, IP Helper, Kernel Streaming, WOW Thunk, UxTheme, WDAC, SCSI Class, Windows Search, Windows Media Foundation, Windows PDF, Windows Speech, OpenSSH
• Microsoft Account, Microsoft Authenticator, Microsoft Dynamics 365, Microsoft Exchange Server, Microsoft Graph, Microsoft Install Service, Microsoft JScript, Microsoft Local Security Authority (lsasrv)
• Other components: Connected Devices Platform Service, Data Sharing Service, Client GitHub Copilot, Microsoft Graphics Component, Microsoft WebP Image Extension, Microsoft Windows Codecs Library, Microsoft Windows Media Foundation, Microsoft Windows PDF, Microsoft Windows SCSI Class System File, Microsoft Windows Search Component, Microsoft Windows Speech OpenSSH, Microsoft Trace Data Helper, Microsoft UxTheme Library (uxtheme.dll)

Mitigation Steps

• Run Windows Update or download the cumulative update package for your operating system and architecture.
• Apply updates to all affected Microsoft products, including Office, Azure services, and third‑party applications that depend on Microsoft libraries.
• Verify that the patch was installed by checking the update history and the CVE identifiers in the registry or update logs.
• Reboot systems where required; some kernel driver updates need a full restart.
• Implement monitoring for anomalous authentication or privilege‑escalation attempts, especially around AD and Azure services.
• Consider hardening measures such as disabling legacy protocols, enforcing MFA, and enabling Windows Defender Application Guard for untrusted content.
• Maintain a baseline of known vulnerable components and regularly audit for missing patches.