September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs

This Patch Tuesday attack-surface overview details a large set of critical Microsoft vulnerabilities — including exploited zero-days in the Windows Update Stack and ALPC — plus multiple unauthenticated RCEs affecting core infrastructure (Netlogon, DNS, DHCP, SSTP, MSMQ, NFS), Hyper-V escapes, and Office Preview/Reading Pane RCEs capable of executing code without user interaction; a public PoC for a Microsoft Defender issue was also released. The report warns of widescale impact across enterprise Windows fleets and advises urgent patching and mitigation.