Microsoft Fixes 973 CVEs in September and Acknowledges Two Actively Exploited Zero-Days in Windows

Microsoft published the largest batch of fixes in its history on Patch Tuesday, September 8: 973 CVEs in a single cycle, two of which have confirmed active exploitation by the company itself. The two exploited vulnerabilities affect the Windows Advanced Local Procedure Call (ALPC) and the Windows Update Stack, both elevating local privileges to SYSTEM.

CVE-2026-85880 in ALPC is a heap-based buffer overflow with a CVSS score of 7.8. The attack originates from code already running inside a low-privilege AppContainer and allows an escape from the sandbox to take control of the machine. Volexity and Proofpoint are credited for reporting the flaw to Microsoft, indicating that the exploitation had been observed in the field prior to disclosure. This is the second zero-day in ALPC in four years.

CVE-2026-81963 in the Windows Update Stack also receives a CVSS score of 7.8 and results from improper link resolution: an attacker can force the update service to follow a malicious link and overwrite a system component with a controlled binary. Microsoft credits Romain Deperne, an offensive researcher at Airbus Helicopters, and the Microsoft Threat Intelligence Center for the discovery. This is the first Elevation of Privilege (EoP) in the component exploited in the field since 2022, and the fix covers all supported versions of Windows.

Unprecedented Scale and Expanded Surface

Within the package, Microsoft classifies 113 CVEs as Critical and 860 as Important. Office contains three critical RCEs: CVE-2026-81959 and CVE-2026-81953 in Excel, and CVE-2026-81952 in Word. Kerberos, Key Distribution Center, and Netlogon, pillars of Windows enterprise authentication, also rank among the critical remote vulnerabilities. The surface includes SQL Server, Exchange, SharePoint, Azure, and development tools, which brings the issue into the data centers of companies still operating on-premises servers.

The size of the cycle has practical implications: more patches, more reboots, more maintenance windows, more opportunity for an attacker who has not yet patched. The Talos team observes that ALPC is often chained with another remote execution flaw in real kill chains, emphasizing the need to treat the two exploited EoPs as zero-day priority, even ahead of the Critical RCEs.

Banks, Government, and Brazil in the Crossfire

European and North American banks, running Windows Server and Exchange in their identity layers, are exposed to the same silent escalation pattern: the attacker accesses via phishing, lands in a restricted context, and uses ALPC to gain SYSTEM privileges. In the U.S., JPMorgan and Bank of America manage fleets of tens of thousands of Windows endpoints under outsourced management. In Germany, Deutsche Bank and federal agencies still rely on on-premises Windows infrastructure for internal authentication and suffer the same exposure under the new NIS2 directive.

Brazil enters through the same door: the installed base of corporate Windows in banks, courts, and public agencies is large and often behind on patch cycles. CTIR Gov and Serpro will have to propagate both fixes in short windows if they want to prevent the exploitation observed by Volexity and Proofpoint from reaching federal assets. Itaú and Bradesco carry the same Windows identity surface in the corporate services that support investment and private banking.

One less discussed detail of the cycle is the source of half the discovery. Airbus Helicopters appears as a reference for threat intelligence on Windows Update. A European aerospace vendor conducting offensive research on a critical Microsoft subsystem is no accident. It is the new design of corporate defense, where major users begin to treat vendor codebases as part of their own risk surface instead of waiting for the vendor’s supply chain.