Microsoft just released its largest Patch Tuesday on record for September 2026: 974 vulnerabilities fixed, 2 of them zero-days already being exploited in the wild. The two actively exploited bugs: – CVE-2026-85880 (Windows ALPC privilege escalation) – CVE-2026-81963 (Windows Update Stack privilege escalation) Other notable numbers: 113 rated Critical, with a lot of exposure concentrated in RDS, DNS Server, Exchange, SharePoint, SQL Server, Azure, and Entra ID. If you're triaging this month, the exploited zero-days and network-reachable RCEs on business-critical systems are the ones to get to first. Full writeup here if anyone wants the CVE-by-CVE detail: https://hubs.la/Q04x16660
Source: r/u/socradario · by /u/socradario