Microsoft Patch Tuesday hits 999 flaws with two exploited
Wed, 9th Sep 2026 (Today)
Rapid7 has published an analysis of Microsoft's latest Patch Tuesday release, which covers 999 vulnerabilities across Microsoft and non-Microsoft issues.
Microsoft listed 974 vulnerabilities in its own products, including 723 in Windows. Fixes for 25 non-Microsoft CVEs brought the total close to 1,000. According to Rapid7, that is the highest number of CVEs Microsoft has ever published in a single day.
The release also included two vulnerabilities already being exploited in the wild. Both are elevation-of-privilege flaws affecting Windows components, continuing a familiar pattern in which attackers combine local access with privilege escalation to gain deeper control of a system.
One of the exploited issues, CVE-2026-85880, affects the Windows Advanced Local Procedure Call mechanism. Successful exploitation can give an attacker SYSTEM privileges through a buffer overflow that enables an out-of-bounds write, Rapid7 said.
"Microsoft is aware of exploitation in the wild already. Successful abuse of the flaw underlying CVE-2026-85880 grants an attacker SYSTEM via a buffer overflow that enables an out-of-bounds write, and as we all know by now, this is exactly what would happen during the first five minutes of a technically accurate horror movie about ransomware," said Adam Barnett, Lead Software Engineer at Rapid7.
Rapid7 noted that neither Server 2025 nor Windows 11 received patches for the flaw. That could suggest Microsoft's work to rewrite critical kernel components in Rust is beginning to reduce exposure in some areas.
The second exploited vulnerability, CVE-2026-81963, is in the Windows Update Stack and also leads to SYSTEM privileges. Rapid7 said it stems from improper link resolution, and patches were issued for all supported versions of Windows.
"The relatively pedestrian CVSS v3 base score of 7.8 is no reason for less concern, since no serious attacker will bother developing an intricate one-shot RCE when a two-stage attack chain consisting of low-privileged local access coupled with elevation of privilege will achieve the same ultimate goal much more easily," Barnett said.
Browser gap
Rapid7 also raised questions about Microsoft's handling of browser advisories. For the second month in a row, Microsoft appeared not to have published any desktop browser security advisories between the start of the month and Patch Tuesday.
The absence stood out because Google Chrome had already patched CVE-2026-85046, an exploited zero-day in the V8 JavaScript engine used by both Chrome and Edge. Rapid7 said Edge's stable channel received a fix before Chrome in this case, but Microsoft still had not published a corresponding security advisory.
"In short: if you're patched, you are protected, but if you rely on advisories to know which vulns exist, you could miss this zero-day vulnerability altogether," Barnett said.
Rapid7 said the missing advisory made it harder for defenders to track exposure, especially given the rising volume of vulnerabilities Microsoft is processing. It added that Chrome fixed 11 other vulnerabilities at the same time as CVE-2026-85046, but it remains unclear whether those were also addressed in Edge.
"Only Microsoft knows why this advisory is missing, but there is no reason to suppose that Microsoft is somehow immune to the pressures that come along with the vast increase in vulnerability volume. A patch without an advisory is perhaps marginally better than an advisory without a patch, but keeping track of exposures without reliable advisory materials is not straightforward," Barnett said.
Rising volumes
Rapid7 said the latest Patch Tuesday underlined how far Microsoft's monthly vulnerability count has risen. It added that there is no reason to expect a return to the lower volumes seen before 2026.
The concentration of 723 Windows vulnerabilities in a single month also highlights the strain on security and IT teams that must test and deploy patches across large estates. Organisations typically have to prioritise exploited flaws first, but the size of the overall release can complicate routine remediation work and asset tracking.
Lifecycle changes
A separate issue for customers is the approaching shift in support status for several Microsoft products. Rapid7 pointed to the upcoming end of servicing for Windows 11 24H2 Home and Pro, while Windows Server 2022 is due to move into extended support, with critical security updates continuing but no further feature development.
The same cycle will also mark the end of the final year of paid Extended Security Updates for Windows Server 2012 and 2012 R2. Office 2021, including the Long-Term Servicing Channel edition, is also moving beyond support without any Extended Security Update option, and Exchange Server 2016 and 2019 are set to lose support as well.
For companies still running older Microsoft software, those lifecycle milestones add another layer of urgency to an already crowded patching agenda. The latest Patch Tuesday showed both the growing scale of Microsoft's monthly fixes and the continuing importance of exploited local privilege escalation bugs in real-world attacks.