Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Microsoft addresses 964 CVEs, smashing July’s release as the largest Patch Tuesday release. This month’s updates include patches for two zero-days that were exploited in the wild. Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 104 rated critical and 860 rated as important. This month’s update includes patches for: Active Directory Certificate Services (AD CS) Active Directory Federation Services (AD FS) Connected Devices Platform Service (Cdpsvc) Kernel Streaming WOW Thunk Service Driver Microsoft Azure Attestation service and Device Health Attestation Service Microsoft Local Security Authority Server (lsasrv) Microsoft Windows SCSI Class System File Reliable Multicast Transport Driver (RMCAST) Windows Ancillary Function Driver for WinSock Windows Connected User Experiences and Telemetry Windows Device Association Broker service Windows IP Address Management (IPAM) Service Windows Internet Connection Sharing (ICS) Windows LDAP - Lightweight Directory Access Protocol Windows Link Layer Topology Discovery Protocol Windows Online Certificate Status Protocol (OCSP) Windows Program Compatibility Assistant Service Windows Remote Access Connection...