Microsoft’s Record September Security Release Fixes Two Windows Flaws Used in Attacks

NEW YORK — Microsoft’s September security release patched two Windows vulnerabilities that the company says had already been exploited, making installation of this month’s updates an immediate priority for consumers, businesses and public agencies.

Both flaws allow an attacker who already has limited access to a machine to raise privileges to the powerful SYSTEM level. They are not described as attacks that can compromise any Windows computer directly from the internet with no prior foothold. But privilege-escalation bugs are valuable to intruders because they can turn an initial, constrained breach into broad control of a device.

The first, tracked as CVE-2026-81963, affects the Windows Update Stack. Microsoft’s advisory describes it as an improper link-resolution and access-control problem. The company assigned it a CVSS base score of 7.8, rated it “Important,” and said exploitation had been detected. An attacker needs local access and low privileges, but the attack does not require another user to take an action, according to Microsoft’s assessment.

The second, CVE-2026-85880, affects Windows Advanced Local Procedure Call, or ALPC, a core mechanism that Windows processes use to communicate. Microsoft identified the weakness as a heap-based buffer overflow, also gave it a 7.8 base score and said it had been exploited in the wild. Security firm Tenable said successful exploitation could grant SYSTEM privileges.

Microsoft has not publicly explained how either flaw was used in attacks. That limits what defenders can infer about the victims, operators and scale of the activity. It does not lessen the practical message: supported Windows machines should receive the September updates promptly through normal enterprise management tools or Windows Update.

The scale of the wider release is striking, although security researchers differ slightly on the count. BleepingComputer counted 966 flaws fixed in Microsoft’s Sept. 8 Patch Tuesday release, including 105 rated Critical. Tenable counted 964 CVEs, with 104 Critical and 860 Important. Such discrepancies can result from different counting methods, and neither changes the status of the two exploited vulnerabilities.

BleepingComputer described the release as Microsoft’s largest Patch Tuesday to date and said it included 258 remote-code-execution vulnerabilities and 438 elevation-of-privilege vulnerabilities. The publication excluded 204 issues Microsoft had fixed earlier in the month across cloud and other products. Tenable likewise characterized the monthly CVE total as a record.

One especially severe issue beyond the two zero-days is CVE-2026-69730, a Windows DNS Server remote-code-execution vulnerability. Tenable said it carries a 9.8 score and could be triggered by an unauthenticated remote attacker sending a crafted packet. Microsoft assessed exploitation as more likely, according to Tenable. That flaw matters most to administrators running affected Windows servers rather than typical home users, but it raises the urgency for organizations operating network infrastructure.

For New York employers, hospitals, schools, nonprofits and government offices, the size of the release makes disciplined patch management more important than a simple instruction to “update.” Technology teams need to identify exposed systems, prioritize vulnerabilities that are being exploited or are remotely reachable, test updates where necessary and confirm deployment. A dashboard that says an update was approved is not the same as evidence that every endpoint installed it.

Individual Windows users have a shorter checklist. Open Settings, navigate to Windows Update, check for updates and restart if prompted. Users should confirm that the update completed rather than postponing a restart indefinitely. Devices that no longer receive security support require a different decision: enroll in an available extended-security program, upgrade to a supported version or replace the machine.

No patch can erase an intrusion that happened before installation. Organizations with reason to suspect compromise should investigate logs and endpoint alerts rather than treating the update as a cleanup tool. Because both zero-days require an attacker to begin with some level of access, defenders should also review how that initial access might be obtained, including stolen credentials, malicious files and exploitation of a separate vulnerability.

The two flaws illustrate why “local” does not mean harmless. A bug with a local attack vector can be one stage in a larger chain. Once an attacker lands on a machine as an ordinary user or through another weakness, privilege escalation may disable protections, expose data or help the attacker move deeper into a network.

The record number of fixes also should not be read as proof that Windows suddenly became hundreds of times less secure in one month. Patch totals reflect disclosure timing, product scope and counting choices as well as underlying security. BleepingComputer reported that Microsoft’s increased use of AI-assisted vulnerability discovery contributed to the rise. Finding and fixing more defects can create a daunting update list while reducing risk—provided users and administrators deploy the corrections.

For this release, the clearest signal is not the headline number. Microsoft has confirmed real-world exploitation of two Windows flaws, and fixes are available now. The safest response is prompt installation followed by verification.