Microsoft Releases Record 966 Patches in Largest Patch Tuesday Ever, Including Two Actively Exploited Zero-Days
Microsoft has delivered its largest-ever monthly security update, releasing patches for a record 966 vulnerabilities in the September Patch Tuesday cycle. This marks the biggest single-month fix count in the company's history and significantly exceeds the 570 issues addressed in July and the 400 resolved in August.
The update closes two actively exploited zero-day vulnerabilities. The first, CVE-2026-81963, resides in the Windows Update stack and stems from improper link handling. An authenticated local attacker could leverage it to escalate privileges to SYSTEM level. The second zero-day, CVE-2026-85880, affects the Windows ALPC mechanism through a buffer overflow that similarly grants attackers SYSTEM privileges. Microsoft has not disclosed details on the attack campaigns or the threat actors behind the exploitation.
Of the total fixes, 105 vulnerabilities carry a critical severity rating. The largest categories are privilege-escalation issues (438) and remote-code-execution flaws (258). Additional problems allow security-feature bypasses, information disclosure, denial-of-service conditions, and data tampering.
The 966 patches do not include another 204 vulnerabilities fixed earlier in September in products such as Azure, Copilot Studio, Entra ID, Edge, Microsoft Fabric, and Power Automate. The sharp increase in volume aligns with Microsoft's recent adoption of an AI-powered system designed to identify security bugs in its own software.
Selected Patched Vulnerabilities
- .NET – Multiple Elevation of Privilege and Information Disclosure issues (CVE-2026-69805, CVE-2026-58649, CVE-2026-69806)
- Active Directory Certificate Services (AD CS) – Several Elevation of Privilege and Tampering vulnerabilities (CVE-2026-69821, CVE-2026-69624)
- Azure AI Language and Azure Cosmos DB – Critical Elevation of Privilege and Spoofing flaws
- Graphic Fonts – Critical Remote Code Execution vulnerabilities (CVE-2026-72986, CVE-2026-73018)
Administrators are strongly advised to apply the updates immediately, especially on systems exposed to the internet or handling sensitive workloads.
Related articles
cKEV Index Launches to Prioritize Vulnerabilities Using Urgent Patch Score Methodology
CyberOK has introduced the open cKEV Index, a catalog of high-priority vulnerabilities based on the Urgent Patch Score (UPS) framework that tracks signals such as exploit publication and confirmed attacks. The index addresses the growing gap between accelerated vulnerability discovery powered by AI and the slower pace of patching, testing, and deployment in real environments. It incorporates timelines from sources including Anthropic reports on AI-assisted campaigns GTG-50014 and GTG-50029, the rust-in-peace framework, Microsoft Exchange Server Subscription Edition delays, and Oracle’s record 1,434 CVE fixes. UPS defines progressive phases from Radar to Emergency/IR, allowing teams to link specific events like PoC releases or CISA KEV additions to concrete actions under resource constraints. Research using 2025 CISA KEV data shows that early signals enable 35–53% of patches to be completed before official exploitation confirmation. The public version displays only Urgent Patch and Emergency stages with event histories, while full data and API access are available to CyberOK customers.
Multiple Vulnerabilities Found in WatchGuard Access Points Including Critical Flaw
WatchGuard Technologies has disclosed three vulnerabilities affecting its WatchGuard AP access point products, one of which is rated critical. The issues were detailed in an advisory published on September 28 and involve flaws in internal API services and a diagnostic command-line interface. CVE-2026-86102 allows OS command injection that can lead to arbitrary shell command execution on the underlying operating system when an attacker has network access. CVE-2026-101891 stems from improper access controls that permit unauthenticated acquisition of valid API sessions. CVE-2026-87969 affects the diagnostic CLI and enables arbitrary OS command execution but requires administrator privileges to exploit. The findings were reported by Security NEXT.
CISA Adds Two Critical Citrix NetScaler Flaws to Known Exploited Vulnerabilities Catalog
The CISA has added two critical vulnerabilities affecting Citrix NetScaler ADC and Gateway to its Known Exploited Vulnerabilities catalog following reports of active global exploitation. Both CVE-2026-88771 and CVE-2026-88772 carry a CVSS score of 9.5 and were patched by Citrix on September 27, the same day they were added to the catalog. The first flaw stems from improper input validation and allows unauthenticated arbitrary command execution on default installations. The second issue involves a buffer overflow that can lead to remote code execution or denial of service when DTLS is enabled on VPN virtual servers. Affected versions include 14.1-73.32, 13.1-63.21 and earlier, with fixes available in 14.1-73.37, 13.1-64.23 and later releases including FIPS variants. The issues were identified by watchTowr on September 26, and Citrix confirmed ongoing attacks against unpatched systems. Organizations are advised to apply patches immediately while preserving evidence and following full incident response procedures.
Apple Patches Zero-Day CVE-2026-86950 in CoreGraphics Exploited in Targeted iOS Attacks
Apple has released emergency security updates for iPhone, iPad, and multiple macOS versions to address a zero-day vulnerability tracked as CVE-2026-86950. The flaw resides in the CoreGraphics framework responsible for rendering images, text, and 2D graphics. It was discovered by Meta Product Security and confirmed to have been used in sophisticated, targeted attacks against specific iOS users. The vulnerability is an out-of-bounds write that could allow arbitrary code execution when processing a specially crafted file. Apple states the attacks were highly selective rather than widespread. Patches are included in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. An erroneous CVE identifier, CVE-2026-20700, appeared in some early reports.