Microsoft September 2026 Patch Tuesday: 966 Vulnerabilities and 2 Zero-Days Put Patch Management to the Test

Microsoft's September 2026 Patch Tuesday is not a routine monthly update.

Microsoft released security updates addressing 966 vulnerabilities, making this the company's largest Patch Tuesday release on record. The updates include 105 critical vulnerabilities and two zero-day vulnerabilities that Microsoft says were already being actively exploited.

For businesses running Windows endpoints, Windows Server environments, Microsoft 365, or other Microsoft technologies, the scale of this release reinforces an important reality: patch management has become an ongoing security and infrastructure responsibility, not simply a monthly task someone handles when time allows.

SafeStorz has been following this trend throughout 2026, including Microsoft's June Patch Tuesday and the record-breaking July Patch Tuesday. September raises the stakes again.

The number 966 gets attention. But from an operational perspective, the two vulnerabilities already being exploited deserve even more attention.

What Microsoft Fixed in September 2026

According to BleepingComputer's coverage of Microsoft's September Patch Tuesday, the vulnerabilities addressed in the release include:

• 438 elevation of privilege vulnerabilities

• 258 remote code execution vulnerabilities

• 173 information disclosure vulnerabilities

• 56 denial-of-service vulnerabilities

• 19 security feature bypass vulnerabilities

• 16 spoofing vulnerabilities

Among the 105 vulnerabilities classified as critical, 81 involve remote code execution and 20 involve elevation of privilege. Those categories matter because they describe what an attacker may be able to accomplish after successfully exploiting a vulnerability.

Remote code execution vulnerabilities can potentially allow malicious code to execute on an affected system. Elevation-of-privilege vulnerabilities can allow an attacker who already has some degree of access to gain more powerful permissions.

That brings us to the most urgent part of this month's release.

Two Zero-Day Vulnerabilities Were Already Being Exploited

Microsoft patched two actively exploited zero-day vulnerabilities this month.

The first, CVE-2026-81963, affects the Windows Update Stack. Microsoft describes it as an elevation-of-privilege vulnerability that can allow an authorized local attacker to gain SYSTEM privileges.

The second, CVE-2026-85880, affects Windows Advanced Local Procedure Call (ALPC) and can also allow an attacker to elevate privileges locally.

Microsoft has not publicly detailed how the vulnerabilities were being used in attacks.

For businesses, however, "actively exploited" is enough information to make prioritization important.

Once a vulnerability is known to be under active attack, patching is no longer about preparing for something that could eventually happen. Organizations have evidence that attackers are already attempting to take advantage of the weakness.

966 Patches Do Not Mean Businesses Should Install Everything Blindly

A Patch Tuesday this large creates another challenge: prioritization. Most organizations are not running every Microsoft product affected by all 966 vulnerabilities. The actual risk to a business depends on its environment, including its operating systems, servers, applications, endpoints, configurations, and security controls.

That means effective patch management starts with visibility. Organizations need to know what they operate, which systems are affected, which vulnerabilities present the greatest risk, and whether an update could affect a critical business application.

This becomes particularly important for companies running ERP platforms, databases, manufacturing applications, financial systems, or other workloads where unplanned downtime can disrupt the business.

Simply clicking "update everything" is not much of a patch management strategy.

Neither is waiting several weeks because no one is sure what can safely be updated.

The goal is to have an established process for evaluating, testing, deploying, and verifying security updates.

Patch Management Gets Harder as Infrastructure Ages

One of the biggest obstacles to consistent patching is often the infrastructure itself.

Older servers and legacy applications can make organizations hesitant to deploy updates because of compatibility concerns. Unsupported operating systems create an even larger problem because security fixes may no longer be available at all.

Over time, that creates an environment where technical debt becomes security debt.

SafeStorz explores this issue further in "The Hidden Risks of Unsupported Operating Systems and Legacy Servers". Systems can continue functioning long after support ends, but that does not mean they remain safe to operate.

For organizations dealing with aging systems, this Patch Tuesday is a good reason to review which Windows versions and business-critical applications are still operating and whether those systems remain fully supported.

The conversation may also need to extend beyond individual operating systems. As SafeStorz explains in "Why Infrastructure Modernization Is About More Than Replacing Old Servers," aging environments often contain a combination of outdated operating systems, inconsistent security policies, disconnected infrastructure, and backup strategies that have not kept pace with the business.

Modernization can make future patch cycles more predictable while reducing the number of exceptions IT teams have to work around.

Patching Is Only One Layer of Cybersecurity

Even a well-managed patching process cannot eliminate every vulnerability immediately.

Updates need to be identified, evaluated, tested, deployed, and verified. Some systems may require maintenance windows. Other vulnerabilities may not yet have patches available when they're first discovered.

Security therefore needs additional layers capable of identifying suspicious activity if prevention fails.

SafeStorz uses Cynet XDR with 24/7 managed detection and response, alongside controls including zero-trust architecture, hardware MFA, role-based access controls, Conditional Access, and hardened administrative access.

Cynet provides detection and response across endpoint, identity, and network activity, giving organizations another layer of protection beyond vulnerability remediation.

This becomes particularly important when attackers attempt to interfere with security tools themselves. SafeStorz recently examined that issue in "When the Antivirus Dies First: Why an EDR Killer Means Nothing If a Human Is Still Watching," which explains why detection technology and continuous human monitoring need to work together.

That distinction matters.

Patching reduces known exposure. Monitoring helps identify problems. XDR and MDR help detect and respond when suspicious activity occurs. Backup and disaster recovery help the organization recover if prevention and detection are not enough.

No individual technology removes cybersecurity risk. The strength comes from combining controls.

Visibility Matters More When Vulnerability Counts Grow

September's record-breaking release also illustrates why infrastructure visibility matters.

An IT team cannot reliably patch a system it does not know exists.

Servers get added. Virtual machines remain online after projects end. Remote endpoints fall outside standard management processes. Legacy applications stay operational because nobody wants to touch them.

Over several years, those exceptions can create significant blind spots. SafeStorz uses PRTG for 24/7 infrastructure monitoring with customizable alerting as part of its broader IT infrastructure services.

Monitoring does not replace patch management, but it contributes to the visibility needed to maintain a healthy environment. Combined with accurate inventories and standardized configurations, it becomes easier to identify systems that require attention instead of discovering them during an incident.

What Happens If a Vulnerability Leads to an Incident?

Security planning should also account for the possibility that prevention fails. A vulnerability may be exploited before an organization can deploy a patch. Credentials may be compromised through an unrelated attack. Ransomware may reach a system despite other controls.

The organization then needs to answer a different question: Can we recover?

SafeStorz's Backup & Disaster Recovery services protect servers, virtual environments, Microsoft 365 data, ERP systems, databases, endpoints, and other critical applications. SafeStorz's approach emphasizes monitoring and validating backup environments so recovery capabilities are available when they are actually needed.

That makes backup and disaster recovery part of the patch management conversation too. A failed update can cause operational problems. An exploited vulnerability can cause much larger ones. In either case, having a tested recovery strategy provides another layer of resilience.

What Businesses Should Take Away From September's Patch Tuesday

The lesson from 966 vulnerabilities should not be that businesses need to panic every second Tuesday of the month. It should be that organizations need repeatable processes.

A mature patch management program should be able to identify affected assets, prioritize actively exploited and critical vulnerabilities, evaluate compatibility risks, deploy appropriate updates, verify successful installation, and monitor systems afterward.

Organizations also need a plan for systems that cannot be patched immediately.

Network segmentation, endpoint security, identity controls, least-privilege access, monitoring, XDR, and managed detection can help reduce exposure while remediation is underway.

For systems that cannot be upgraded because of critical legacy software or equipment dependencies, SafeStorz has also discussed ways businesses can reduce the risks associated with legacy software, including network segmentation, access controls, monitoring, and tested backups.

The objective is not to pretend every risk can disappear overnight. It is understanding where the risks are and putting controls around them.

Patch Tuesday Should Be a Process, Not an Emergency

Microsoft's September 2026 release is unusual because of its sheer size, but the underlying challenge is not unusual at all. New vulnerabilities are discovered continuously. Some will be critical. Some will already be exploited. Others will affect technologies a particular organization does not even use.

The businesses in the strongest position are not necessarily those that react fastest to every cybersecurity headline. They are the ones that already know what systems they have, keep infrastructure supported, maintain consistent security configurations, monitor their environments, and have a defined process for responding when new vulnerabilities emerge.

That is especially important for organizations in manufacturing, healthcare, financial services, professional services, and other environments where downtime or security incidents can quickly become business problems.

September's Patch Tuesday may have addressed a record 966 vulnerabilities. The bigger question for businesses is much simpler:

When the next critical vulnerability appears, do you already have the infrastructure and processes in place to deal with it?

SafeStorz helps businesses manage that responsibility through proactive server and OS management, 24/7 infrastructure monitoring, layered cybersecurity, private cloud hosting, and backup and disaster recovery designed around keeping critical systems secure, stable, and recoverable.

If you are unsure whether your servers and endpoints are staying current with Microsoft's latest security updates, contact SafeStorz to assess your infrastructure, identify potential gaps, and build a more manageable approach to patching and security.