Microsoft sets Patch Tuesday record with 974 security fixes
Two zero-day vulnerabilities actively exploited amid unprecedented patch volume
1Record-breaking patch release
Microsoft delivered a historic 974 CVEs in September 2026, nearly matching its entire 2025 output of 1,130 vulnerabilities. This follows 421 fixes in August and 622 in July, establishing a concerning trend. Adobe simultaneously addressed 172 CVEs, including the critical StyleSmuggler zero-day affecting Magento and Adobe Commerce. The US CISA mandated federal agencies to patch both Microsoft and Adobe vulnerabilities by September 22 and 11 respectively, highlighting the severity.
2Active zero-day exploits
Two Microsoft vulnerabilities are already under active exploitation: CVE-2026-85880 in Windows ALPC allows sandbox escape to SYSTEM privileges, while CVE-2026-81963 in Windows Update Stack enables similar elevation. Zero Day Initiative's Dustin Childs warns these are likely being combined with code execution bugs for malware distribution. Microsoft also patched nine Exchange Server flaws, with CVE-2026-55007 being particularly dangerous as it allows remote code execution via malicious Visio email attachments without user interaction.
3StyleSmuggler e-commerce threat
Discovered by Sansec, the StyleSmuggler vulnerability (CVE-2026-75650) lets attackers inject PHP code via Magento template styles. Affecting all versions from 2.4.4 to 2.4.9, it installs backdoors connecting to command servers. Attacks began September 4, compromising online stores globally. While the backdoor isn't yet weaponized, Sansec urges immediate patching. Adobe released a hotfix, but many unpatched systems remain vulnerable to this max-severity flaw that bypasses security detections.
4Wormable vulnerabilities surge
The Patch Tuesday release includes 20 wormable vulnerabilities, creating potential for rapid malware spread. Childs notes this concentration is unprecedented in a single update cycle. While exploitability varies, the sheer volume increases attack surface dramatically. Microsoft Exchange Server remains particularly vulnerable, with nine patched flaws including the critical email-based remote code execution vulnerability that requires no user interaction to trigger.
5Missing Edge browser patch
Notably absent from Microsoft's updates is CVE-2026-85046, a Chrome V8 JavaScript engine flaw Google patched September 3. This high-severity type confusion vulnerability affects both Chrome and Edge, yet Microsoft hasn't issued an advisory. Rapid7's Adam Barnett warns this creates tracking challenges, as 11 other Chrome patches' status in Edge remains unclear. Enterprises relying on Microsoft advisories might miss critical vulnerabilities affecting their browser security posture.
6Privilege escalation risks
The two actively exploited Microsoft vulnerabilities both enable privilege escalation to SYSTEM level. CVE-2026-85880 requires only low-privilege AppContainer code execution, while CVE-2026-81963's Windows Update Stack flaw details remain scarce. These complement the Exchange Server's email-based code execution flaw, creating multiple attack vectors. The ALPC vulnerability is particularly dangerous as it requires no additional user interaction after initial access.
7Patch management challenges
The unprecedented volume creates operational burdens for IT teams. Rapid7's Barnett notes patch-without-advisory scenarios complicate vulnerability management. Federal agencies face tight deadlines, while enterprises must prioritize among 974 fixes. The situation underscores growing software complexity and security debt. Microsoft's failure to address the Edge vulnerability despite Chrome's patch raises questions about coordinated disclosure processes across shared codebases.
8Security landscape implications
This record-breaking patch cycle signals worsening software security trends. The combination of volume, active exploits, and wormable vulnerabilities creates perfect storm conditions. Organizations must enhance patch prioritization and accelerate deployment cycles. The incidents highlight critical needs for better software design, more transparent vulnerability disclosure, and improved cross-vendor coordination, especially for shared components like browser engines.