Historic Patch Tuesday: Microsoft Fixes Record 974 Flaws and Two Actively Exploited Zero-Days
By DigitalSpying Threat Research Team
Published: September 10, 2026
Target: Systems Administrators, Enterprise Infrastructure, Windows SecOps
Executive Summary
On September 8, 2026, Microsoft released its monthly security update, shattering all previous Patch Tuesday records with a staggering 974 Common Vulnerabilities and Exposures (CVEs) addressed. Of the total, 10 CVEs involve cloud services managed directly by Microsoft, leaving 964 vulnerabilities requiring customer remediation. Crucially, the release includes fixes for 104 vulnerabilities classified as "Critical" and resolves two actively exploited zero-day elevation-of-privilege vulnerabilities impacting current desktop and server editions of Windows.
This record-breaking release follows a year of dramatic vulnerability volume growth fueled by autonomous AI-assisted code analysis and fuzzing tools deployed across enterprise codebases. CISA immediately acknowledged the severe risk by issuing an emergency alert and directing federal agencies to remediate the zero-days under Binding Operational Directive (BOD) 26-04. System administrators face an unprecedented patch triage workload across Windows 11, Windows Server 2025, Active Directory, and Exchange environments.
Deep-Dive: The Two Actively Exploited Zero-Days
Both zero-day flaws addressed in the September 2026 release are local elevation-of-privilege (LPE) vulnerabilities. While neither flaw allows initial remote access on its own, both provide post-exploitation operators with the exact privilege escalation capabilities required to disable EDR sensors, dump credential hashes, and deploy enterprise-wide ransomware.
September 2026 Zero-Day Escalation Workflow
* Initial Access: Phishing, Stolen Credentials, or Web Exploit
* Context: Low-Privileged User Context on Endpoint
* Attack Path A (CVE-2026-81963): Improper Link Resolution in Explorer/VFS → Arbitrary File Overwrite / Redirection
* Attack Path B (CVE-2026-85880): Race Condition in Storage Driver → Kernel Memory Double-Free Write
* Outcome: Spawn NT AUTHORITY\SYSTEM Shell
* Impact: EDR Disablement, Domain Credential Theft, and Lateral Movement
1. CVE-2026-81963: Windows Link Resolution Elevation of Privilege Vulnerability
* CVSS v3.1 Score: 7.8 (High)
* Vulnerability Type: Improper Link Resolution Before File Access (CWE-59)
* Technical Analysis: This vulnerability exists in the way the Windows Shell and Virtual Filesystem resolve symbolic links, junctions, and mount points during background indexing and user profile maintenance. An authenticated low-privileged user can create a junction pointing to a protected system directory and time a race condition during background system sweeps. When high-privileged system services attempt to read or modify the temporary link, the service follows the malicious redirection, granting the attacker arbitrary file write privileges to write payloads directly into protected system directories such as C:\Windows\System32\, leading to code execution as NT AUTHORITY\SYSTEM.
2. CVE-2026-85880: Windows Kernel Storage Elevation of Privilege Vulnerability
* CVSS v3.1 Score: 7.8 (High)
* Vulnerability Type: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition / Double Free)
* Technical Analysis: Discovered in active use by advanced threat groups, CVE-2026-85880 resides within the Windows kernel storage driver stack. A timing race condition allows a locally authenticated attacker to send malformed I/O Control (IOCTL) requests that corrupt kernel memory structures during device volume dismount sequences. Exploiting this synchronization flaw grants the attacker immediate read/write access to Ring 0 kernel memory, bypassing Kernel Patch Protection (PatchGuard) and elevating low-level process tokens to full system administrator rights.
Vulnerability Breakdown & Key Critical CVEs
The September 2026 release represents the largest single-month vulnerability count in cybersecurity history:
* Total Vulnerabilities: 974 (964 on-premises / customer-managed)
* Critical Severity: 104 CVEs
* Important Severity: 860 CVEs
* Actively Exploited Zero-Days: 2 (CVE-2026-81963 and CVE-2026-85880)
Notable Critical Flaws
1. Windows Message Queuing (MSMQ) Remote Code Execution (CVE-2026-83997): An unauthenticated remote code execution flaw in the MSMQ service (CVSS 9.8). Remote attackers can send crafted MSMQ packets over TCP port 1801 to execute arbitrary code with system privileges.
2. Microsoft Failover Cluster Remote Code Execution (CVE-2026-73010): Allows network-adjacent attackers to execute code inside clustered enterprise server environments (CVSS 8.8).
3. Remote Desktop Services Remote Code Execution (CVE-2026-69525): A memory corruption flaw affecting RDP gateways allowing unauthenticated code execution prior to user login.
Enterprise Prioritization & Remediation Strategy
Faced with nearly 1,000 vulnerabilities, IT and SecOps leaders must implement an intelligent, risk-ranked patch deployment schedule:
Phase 1: Emergency Deployment (Within 24–48 Hours)
* Deploy cumulative security updates addressing CVE-2026-81963 and CVE-2026-85880 across all exposed endpoints and virtual desktop environments.
* Disable legacy MSMQ (TCP port 1801) on all servers where the service is not strictly required to mitigate CVE-2026-83997.
Phase 2: High-Risk Infrastructure (Days 3–7)
* Patch Windows Server Failover Clustering environments (CVE-2026-73010) and Remote Desktop Gateways (CVE-2026-69525).
* Audit domain controllers and Active Directory Certificate Services (AD CS) for unusual machine account enrollments.
Phase 3: Broad Fleet Remediation (Within 14 Days)
* Complete staging and deployment of Windows 11 updates (KB5124008, KB5124012) and Windows Server 2022/2025 cumulative packages across workstations and internal servers.
* Validate endpoint EDR sensor health following reboots to ensure complete agent protection.