September 2026 Patch Tuesday: 974 Flaws, 2 Zero-Days

Microsoft’s September 2026 Patch Tuesday delivers fixes for 974 vulnerabilities, including two actively exploited Windows elevation-of-privilege zero-days (CVE-2026-85880 and CVE-2026-81963) added to CISA KEV; the release contains 113 Critical vulnerabilities and multiple high-severity remote code execution issues (notably DNS Server and Remote Desktop Services), and the report provides prioritized remediation guidance to patch the exploited zero-days first, then network-reachable RCEs and critical infrastructure such as Exchange, SharePoint, SQL Server, and cloud/identity services, while recommending telemetry review and asset rescanning after deployment.