Microsoft's September 2026 Patch Tuesday is one of the largest single releases the company has shipped, addressing 973 distinct CVEs across Windows, Office, SQL Server and its developer tooling. Of those, 113 land in the Critical bucket. Two are confirmed to be under active exploitation.

The raw number is eye-catching, but it is also misleading. A release of this size is not 973 emergencies. For most organisations the practical question is narrow: which handful of these can an attacker use today, and where are those systems?

The two exploited flaws

Both actively exploited bugs are elevation-of-privilege issues, which matters for how you triage them.

CVE-2026-81963 — Windows Update Stack

An elevation-of-privilege weakness in the Windows Update Stack. Because the update mechanism runs with high privilege by design, a flaw here gives an attacker who already has code execution on the host a reliable path to SYSTEM. That makes it attractive as the second stage of an intrusion — after phishing, after a stolen session, after an exploited edge device.

CVE-2026-85880 — Advanced Local Procedure Call (ALPC)

ALPC is the internal Windows IPC mechanism that lets processes talk to each other across privilege boundaries. It has a long history as privilege-escalation territory, and this year's entry follows the pattern: a local attacker abuses the boundary to run code in a more privileged context.

Neither of these gets an attacker onto your network. Both make it dramatically easier to finish the job once they are there. Treat them as the back half of a kill chain, and patch accordingly.

How to triage a 973-CVE release

Trying to risk-rank a thousand CVEs by CVSS is how patch cycles slip. A more workable sequence:

  1. Exploited first, everywhere. The two confirmed-exploited CVEs go out to all Windows endpoints and servers on an accelerated ring. If your normal pilot ring is a week, compress it to 24 hours for these two.
  2. Critical plus internet-facing next. Anything rated Critical on a host that terminates inbound traffic — RDP gateways, Exchange, IIS, SQL Server with exposed listeners — moves ahead of internal workstations.
  3. High-value identity infrastructure. Domain controllers, ADFS, certificate authorities and privileged access workstations. A local privilege escalation on a DC is not a local problem.
  4. Everything else on the standard ring. The remaining hundreds of CVEs are real, but they do not justify breaking your change process.

Detection while you patch

Patching a fleet of any size takes days. In the meantime, both exploited flaws produce behaviour worth alerting on:

  • Unexpected child processes spawned by update-related service hosts.
  • Token manipulation and impersonation events on hosts where no administrative work is scheduled.
  • New services or scheduled tasks created by a process that itself started from a browser, mail client or archive utility.
  • Any SYSTEM-level process launched by an account that has no business holding SYSTEM.

None of these are signatures for the specific exploits. They are the generic tail of a successful privilege escalation, and they work regardless of which CVE was used to get there.

The wider pattern

The gap between "patch released" and "exploit weaponised" has been shrinking for several years, but the more important shift is which flaws attackers bother with. Remote code execution on an edge device still gets the headlines. In practice, the bugs that show up repeatedly in incident response are the unglamorous local privilege escalations that turn a foothold into full control.

That is what both of September's exploited CVEs are. It is a reasonable argument for treating EoP bugs on your standard build with the same urgency you reserve for perimeter RCE — because the attacker who needs them has already cleared the perimeter.

What to do this week

  • Deploy CVE-2026-81963 and CVE-2026-85880 on an accelerated schedule. Confirm coverage with a report, not an assumption.
  • Check whether any hosts have been excluded from patching long enough to accumulate previous EoP flaws — those are your real exposure.
  • Review your EDR coverage on servers specifically. Workstation coverage is usually good; server coverage is where the gaps hide.
  • Confirm that the 113 Critical items map to an owner. Unowned Critical CVEs are how the next incident starts.