Microsoft’s 8 September 2026 Patch Tuesday is its largest security release on record. BleepingComputer counts 966 flaws shipped on Patch Tuesday itself (105 Critical, including 81 RCE), excluding 204 flaws fixed earlier in the month in cloud products. Two actively exploited elevation-of-privilege zero-days are fixed: CVE-2026-81963 (Windows Update Stack link-following to SYSTEM; credited to Romain Deperne and MSTIC) and CVE-2026-85880 (Windows ALPC heap buffer overflow to SYSTEM / AppContainer sandbox escape; Volexity and Proofpoint researchers).

Coverage notes ~20 potentially wormable unauthenticated RCEs in the set and calls out Exchange (CVE-2026-55007), SharePoint (CVE-2026-69465), RDS (CVE-2026-69525), SQL (CVE-2026-65669), and Authenticator (CVE-2026-80097) among high-priority items. Microsoft attributes the volume increase partly to AI-assisted vulnerability discovery. NEW 8 Sep KEV: CISA added both exploited zero-days to the Known Exploited Vulnerabilities catalog on 2026-09-08 (catalog 2026.09.08) — CVE-2026-81963 and CVE-2026-85880 (FCEB dueDate 2026-09-22).

WA SOC advisory 20260909001 (9 September 2026, TLP:CLEAR) summarises the September Monthly Updates as addressing 973 vulnerabilities, highlights critical CVE-2026-69730 and CVE-2026-69525 (CVSS 9.8) plus the two known-exploited EoPs (CVSS 7.8), notes Microsoft detected exploitation of one or more of the mentioned vulnerabilities, and says WASOC has not received WA Government exploitation reports at the time of writing. Prioritise the two exploited EoPs, internet-facing roles, and Extended Security Updates where applicable.

UPDATE (23 Oct 2026; Enclave, Microsoft): Enclave researcher Ofek Levin published details on 23 October of 'AuthMask', a Microsoft Authenticator for Android flaw tracked as CVE-2026-80097, which Microsoft's advisory lists as released on 8 September.

Enclave says Microsoft confirmed and fixed the issue after Enclave reported it. Enclave also says an Android app with zero permissions could pretend to be any installed Microsoft first-party app, such as Teams, and get Authenticator, acting as the sign-in broker, to hand it that app's tokens for a work account signed into Authenticator, because an exported activity trusted the caller's own description of itself; in Enclave's tests the tokens gave full delegated mailbox, files and calendar access and, by impersonating Authenticator's own client, the ability to create and delete passkeys, with no user interaction beyond having Authenticator signed in to a work account.

Microsoft's advisory (released 8 September) rates it CVSS 3.1 8.6, Important, says an attacker would need to install a malicious app on the device and convince the user to complete an authentication flow in Authenticator, and lists it as not exploited and not publicly disclosed at the time of original publication; the CVE record lists Microsoft Authenticator for Android from 6.0.0 to before 6.2606.4246 as affected.

Help Net Security reported the research on 27 October. (source: Enclave; Microsoft Security Update Guide CVE-2026-80097; Help Net Security)

Correction (29 Oct 2026): removed a CVE count credited to SecurityWeek and Krebs, which are not linked sources. (source: Microsoft)