On September 8, 2026, Microsoft released its largest security update ever - fixes for 966 vulnerabilities, including two Windows flaws that attackers are already exploiting in the wild. If your business runs Windows PCs or servers, the most important thing you can do this week is install the September updates.
Quick answer: Microsoft’s September 2026 Patch Tuesday, released September 8, fixed a record 966 security flaws - including two Windows zero-days (CVE-2026-81963 and CVE-2026-85880) that Microsoft confirms are already being exploited, according to BleepingComputer. Both let an attacker who already has a foothold on a machine take full control of it. Install this month’s Windows updates on every PC and server this week.
What happened?
On September 8, Microsoft shipped its monthly Patch Tuesday updates - the largest release in the company’s history. BleepingComputer counted 966 vulnerabilities fixed, well past the previous record of 570 set in July. Of those, 105 are rated Critical, and 81 of the critical ones are remote code execution flaws - the kind that can let malware seize control of a machine with little or no user interaction.
Two of the fixed flaws matter most, because Microsoft says both are already being exploited:
- CVE-2026-81963 - Windows Update Stack elevation of privilege. An improper link resolution (“link following”) flaw that lets an attacker who already has access to a machine elevate to SYSTEM privileges - the highest level of control on Windows. It was credited to researcher Romain Deperne and Microsoft’s own Threat Intelligence Centre.
- CVE-2026-85880 - Windows Advanced Local Procedure Call (ALPC) elevation of privilege. A heap-based buffer overflow that also lets an attacker escalate to SYSTEM privileges. It was found by researchers at Volexity and Proofpoint.
Microsoft has not shared details about the attacks, which is typical while exploitation is still active. The same day, Microsoft also released the Windows 10 KB5122878 extended security update for organizations still running Windows 10.
One piece of context: the record volume does not mean Microsoft’s software suddenly fell apart. As BleepingComputer reported, the increase follows Microsoft’s adoption of an AI-powered vulnerability discovery system. Every flaw found and fixed is one an attacker can no longer use.
Why does this matter for small businesses?
For Pennsylvania small businesses and nonprofits, three parts of this story matter.
Every Windows machine you own is in scope. The two actively exploited flaws are in Windows itself - components that exist on every Windows PC and server. The action item is identical whether you have 5 employees or 500: patch.
These are second-stage attacks - which is why the first stage still matters. Neither zero-day lets an attacker in by itself; both require some existing access, usually a phished password or malware. What they do is turn that foothold into full SYSTEM control. KrebsOnSecurity quoted security specialist Deborah Galea of Filigran on this pattern: “Local privilege-escalation bugs are the second stage in nearly every real intrusion.” This week’s patch removes the second stage - but multi-factor authentication and staff phishing awareness remain what prevents the first.
966 vulnerabilities is unmanageable - and it does not need to be. No small business should read 966 CVEs. The realistic approach is risk-based patching: keep the systems you actually run - for most small organizations, Windows and Microsoft 365 - current within days of Patch Tuesday, not months.
What should you do this week?
-
Install the September 2026 Windows updates on every PC and server. Do not defer them. Both exploited zero-days are included in this month’s cumulative updates, available through Windows Update or your patch management tool.
-
Restart the machines. Updates to core Windows components - including the Update Stack itself - need a restart to finish. A machine that downloaded the update but has not rebooted is not fully patched.
-
If you still run Windows 10, confirm you are enrolled in Extended Security Updates. Microsoft released the Windows 10 KB5122878 ESU update on September 8. If your Windows 10 machines are not enrolled, they are not receiving security fixes at all.
-
Keep the first-stage defenses on. Because both zero-days require the attacker to already have access, the everyday controls - multi-factor authentication on email and business accounts, and staff who pause before opening unexpected attachments - are what stop the foothold in the first place.
-
If someone else manages your IT, ask one direct question. “Are all of our Windows machines patched with the September 2026 updates, including the two actively exploited zero-days?” A good IT partner answers with a status report, not a shrug.
Frequently asked questions
Do these Windows zero-days affect my small business? Yes, if your business runs Windows. Both CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows ALPC) exist in Windows itself, and both are elevation of privilege flaws - an attacker first needs a foothold, such as a phished password, then uses the flaw to take full SYSTEM-level control. Installing the September updates removes that second step.
What is a zero-day vulnerability? A zero-day is a flaw that is actively exploited or publicly disclosed before a fix is available. Microsoft classifies a flaw as a zero-day when it is exploited while no official fix exists, as BleepingComputer explains. Once the patch ships, the priority is installing it before attackers widen their campaigns.
Why did Microsoft fix a record 966 vulnerabilities this month? Per BleepingComputer, September 2026 is Microsoft’s largest security update ever, surpassing July’s record of 570. The increase follows Microsoft’s adoption of an AI-powered vulnerability discovery system. More fixes is good news - each one is closed before attackers can use it.
We still have Windows 10 PCs. Are we covered by these updates? Only if they are enrolled in Windows 10 Extended Security Updates (ESU). Microsoft released the Windows 10 KB5122878 ESU update on September 8. If your Windows 10 machines are not enrolled, they are not receiving security fixes at all - which should move to the top of your IT to-do list.
What is the single most important thing to do this week? Install the September 2026 Windows updates on every Windows PC and server, and restart so they finish. If someone else manages your IT, ask them to confirm every machine is patched - including the two actively exploited zero-days.
Where Merit IT fits in
Patch Tuesday arrives every month, and the two-zero-day months are the ones that separate proactive IT from reactive IT. At Merit IT, tracking Microsoft’s security updates and CISA’s advisories is part of our IT support practice - we apply the updates, verify they completed, and restart machines during maintenance windows so it does not disrupt your workday. It is part of keeping the lights on, not a separate emergency engagement.
We work with small businesses and nonprofits across Pennsylvania month-to-month - no long-term contract. We earn your business every single month, or we do not.
Get a free technology assessment - we will review your patch status, your Windows 10 situation, and your overall security posture, and give you a clear picture of where you stand. No obligation, no pressure. Or keep reading on the Merit IT blog for more practical, no-hype IT guidance.