PATCH Tuesday for September 2026 arrives with a record-breaking update release from Microsoft, according to the Rapid7 briefing. The company reports that 974 of its own-product vulnerabilities are being published today, including 723 in Windows, with a total of 999 vulnerabilities on the table. Rapid7 notes exploitation in the wild for two of the published flaws, underscoring the scale and potential immediacy of risk for affected organisations.
The patch set covers a wide range of product families, from Windows and server components to browsers and development tools, with multiple CVEs flagged as exploited or more likely to be exploited in certain conditions.
Of particular note are two zero-day elevation-of-privilege flaws that Rapid7 states are already being exploited in the wild. CVE-2026-85880, impacting Windows ALPC, can grant SYSTEM-level privileges via a buffer overflow that enables an out-of-bounds write; Rapid7 highlights the unpatched status for Server 2025 and Windows 11 in relation to this CVE, while noting Microsoft’s ongoing memory-safety improvements in kernel components.
CVE-2026-81963 affects the Windows Update Stack and also leads to SYSTEM privileges through improper link resolution; the advisory emphasises that all supported Windows versions will receive a patch. Additionally, the piece flags a Chrome patch for CVE-2026-85046, a zero-day exploited in the wild, with Edge yet to publish a security advisory for that flaw, suggesting a potential gap in guidance for some users.
Finally, the article notes October 2026 lifecycle updates, including end-of-servicing for Windows 11 24H2 Home & Pro and the end of ESU for several older Windows and Office products.