Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

Microsoft released its largest Patch Tuesday, addressing 974 vulnerabilities across Windows, Office, SQL and developer tools — including two actively exploited Windows privilege-escalation zero-days (CVE-2026-81963 and CVE-2026-85880, both CVSS 7.8). The report notes that AI-assisted discovery is increasing disclosed defects, but active exploitation remains limited; security teams are advised to focus remediation on vulnerabilities that pose real risk to their environments rather than treating the entire patch list as equally urgent.