Nearly 1,000 Windows Fixes in One Month: Two Zero-Days Already Being Exploited
Microsoft's September 2026 Patch Tuesday lands 964 security fixes, two of them already in active use by criminals, plus roughly 20 bugs that could spread automatically across networks.
Key points
- Microsoft issued 964 security fixes on September Patch Tuesday 2026, the largest single-month total since the company began using AI to find flaws mid-year.
- Two zero-days, meaning flaws exploited before a patch existed, are confirmed in active use against Windows systems.
- A Windows DNS flaw tracked as CVE-2026-69730 has not yet been exploited but Microsoft expects it will be, and researchers warn it could move like a self-replicating worm.
- SAP patched a perfect-score flaw (10.0 out of 10) in software used by large enterprises worldwide.
- Adobe, Fortinet and Cisco each released urgent fixes for vulnerabilities that criminals are already exploiting.
What just happened?
Microsoft pushed fixes for 964 security flaws on its regular monthly update day, known as Patch Tuesday, breaking its own records. The company credits AI tools it began deploying mid-year with surfacing flaws faster than human researchers alone ever could.
Not every organisation will face every flaw. But two of them are being used by criminals right now, and that's what makes this month's update unusually urgent.
Which vulnerabilities are being exploited right now?
Two zero-days are confirmed. Both let attackers gain elevated control over a Windows machine.
| CVE ID | What it affects | What attackers can do | Actively exploited? |
|---|---|---|---|
| CVE-2026-85880 | Windows ALPC (an internal messaging system letting programs talk to each other) | Escape a restricted software environment and gain higher-level control | Yes |
| CVE-2026-81963 | Windows Update Stack (the mechanism that delivers software updates) | Gain full system-level privileges | Yes |
| CVE-2026-69730 | Windows DNS (the system that translates website names into addresses) | Run malicious code remotely with no password or user action | Not yet, but expected |
| CVE-2026-62893 | Windows Deployment Services | Spread automatically across a network | Not confirmed |
| CVE-2026-69590 | Windows Routing and Remote Access | Spread automatically across a network | Not confirmed |
CVE-2026-85880 affects Windows Server 2012, 2016, and Windows 10. Ivanti's vice-president of product management Chris Goettl said it "affects the entire Windows fleet." CVE-2026-81963 targets Windows 11 and Windows Server 2025.
Could any of these spread on their own?
Yes, and that's the detail keeping security teams up at night. Dustin Childs, who leads threat awareness at the Zero Day Initiative, counted roughly 20 vulnerabilities in this batch that could be "wormable," meaning malicious software could use them to copy itself from machine to machine without anyone clicking anything.
The DNS flaw, CVE-2026-69730, is drawing the most concern. A single crafted network packet is enough to execute code on a target machine, with no credentials needed and no action required from the victim. Childs called it a spiritual successor to SigRed, a 2020 DNS worm vulnerability that alarmed the industry at the time. We first covered wormable vulnerability threats on 8 September 2026, and the pattern of DNS-level risk is accelerating rather than easing.
What about software beyond Windows?
Several other major vendors also pushed urgent fixes this month.
SAP patched a flaw scoring 10.0 out of 10 on the standard severity scale in its Extended Passport Processing component, which logs document creation and traces transactions inside enterprise suites like SAP S/4HANA and NetWeaver. Three of this month's SAP fixes require no valid login credentials for an attacker to exploit them.
Adobe fixed an actively exploited zero-day in Adobe Commerce and Magento tracked as CVE-2026-75650, rated 10.0. Researchers named it StyleSmuggler; it plants hidden backdoors on Linux servers. Adobe rated it "Urgent Action." Our August coverage of Adobe patches noted critical remote-code-execution risks in the same product family, so this active exploitation isn't a surprise.
Fortinet confirmed criminals are actively using two older authentication bypass flaws in FortiOS, letting attackers take over edge firewalls, the devices sitting between an organisation's network and the internet, without a password. Cisco warned of active exploitation of a denial-of-service flaw in its Secure Firewall product, tracked as CVE-2026-20349.
Should ordinary people worry?
Windows users at work need their IT teams patching now. If you shop on a site running Adobe Commerce or Magento, the store's operator needs to move immediately. Watch bank statements and email for anything odd over the coming weeks.
For everyone else: don't ignore the prompt to restart after an update. That restart is often what actually applies the fix.
The real story here isn't the record count. It's that AI-assisted discovery is creating a permanently elevated baseline, and the window between a patch dropping and criminals reverse-engineering it keeps shrinking.
