This month’s Microsoft Patch Tuesday delivered a record 974 CVEs, the largest single-month haul in the company’s history. That is well above the 421 fixes it shipped in August. Two of the flaws are already under active attack, Microsoft says, and federal agencies have until September 22 to patch them.
The jump is stark. Microsoft patched 622 CVEs in July, according to security firm Tenable. The September total is not far off the 1,130 CVEs Microsoft disclosed across all of 2025. One month now accounts for roughly 86 percent of what a typical full year looked like not long ago. Nine of this month’s bugs affect Exchange Server. Adobe separately pushed out fixes for 172 more vulnerabilities the same day, including one already being exploited to break into online stores.
Two zero-days already under attack in this Microsoft Patch Tuesday
The first confirmed zero-day, CVE-2026-85880, sits in Windows‘ Advanced Local Procedure Call system, a mechanism Windows processes use to talk to one another across privilege levels. An attacker who already has low-level code execution inside a sandboxed AppContainer can use the flaw to escape that sandbox. From there, Microsoft warned, the attacker can gain SYSTEM privileges without needing any further action from the victim. AppContainers are meant to keep a compromised app, such as a browser tab or a restricted service, from touching the rest of the operating system. A working sandbox escape removes that safety net entirely.
That makes the bug most useful as the second half of an attack chain. An attacker still needs an initial foothold first, typically through a separate flaw or a malicious file. Only then does ALPC privilege escalation turn limited access into full control of the machine. It rarely makes headlines on its own, but it shows up in almost every serious Windows intrusion once paired with something else.
Microsoft has not said who is exploiting the bug or why. The Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on Tuesday. It did the same for a second Microsoft zero-day and for the Adobe Commerce flaw described below. Federal civilian agencies now have until September 22 to fix both Microsoft bugs.
The second zero-day, CVE-2026-81963, is another privilege escalation flaw, this one in the Windows Update Stack. Details remain thin, but it also hands an attacker SYSTEM-level access once triggered. Dustin Childs of Trend Micro’s Zero Day Initiative suspects the bug will end up paired with something else. “More likely is that this bug is being combined with a code execution bug to spread malware or ransomware,” he wrote, urging administrators to patch it quickly.
An Exchange Server bug that only needs one shot
Among the nine Exchange Server fixes this month, Childs rates CVE-2026-55007 as the one to prioritize. It lets an unauthenticated attacker run code on a vulnerable server by sending an email with a malicious Visio attachment. The payload executes when the server indexes the file, so the recipient never has to open it.
Content indexing runs automatically in the background on every incoming message. It scans attachments so users can later search their inbox for text inside a document. That automation is what makes the bug dangerous: there is no phishing click to avoid and no attachment to warn staff away from. The email only has to reach the mail server.
Microsoft describes the bug as difficult to reliably trigger. Childs is unconvinced that makes it low risk. “The attacker only needs to get it right once,” he said. “Schedule your downtime and update your Exchange servers with haste.” He counts 20 patches this month for wormable bugs across Microsoft’s release, the kind that can spread from machine to machine without any user interaction.
Adobe’s Magento problem runs in parallel
Adobe shipped its own patches on Tuesday: ten bulletins covering 172 CVEs. Among them is a maximum-severity flaw in Magento and its successor platform, Adobe Commerce. E-commerce security firm Sansec found the bug, tracked as CVE-2026-75650 and nicknamed StyleSmuggler. Sansec reports that attacks began on September 4, days before Adobe’s Monday hotfix went out.
The flaw lets an attacker inject malicious PHP code into Magento templates through the platform’s “styles” properties, a method that slips past standard safety checks. Confirmed attacks install a backdoor that connects to a command-and-control server and waits for further instructions. “So far, we have no indication that the backdoor has been weaponized,” Sansec’s forensics team wrote. Every Magento and Adobe Commerce release from 2.4.4 through 2.4.9 carries the flaw. CISA has given federal agencies until September 11 to patch it, a tighter window than the one set for Microsoft’s own zero-days.
The short gap between discovery and mass exploitation stands out here. Sansec traced the first attacks to September 4, roughly a week before Adobe’s Monday hotfix. Stores running an affected version were exposed well before a fix existed. Any store that has not applied the hotfix should treat its server as compromised until proven otherwise, rather than assume an unpatched system has simply gone unnoticed.
The Chrome bug Microsoft hasn’t acknowledged
One more vulnerability sits outside this month’s Patch Tuesday roundup entirely. Google patched CVE-2026-85046, a type confusion flaw in its V8 JavaScript engine, on September 3. At the time, Google said an exploit already existed in the wild. V8 also powers Microsoft Edge, but Microsoft has yet to publish a security advisory for the bug.
“If you’re patched, you are protected, but if you rely on advisories to know which vulns exist, you could miss this zero-day vulnerability altogether,” Adam Barnett, lead software engineer at Rapid7, told The Register. Chrome’s September 3 update covered 11 other vulnerabilities alongside CVE-2026-85046. Barnett says it isn’t clear whether Edge has received the same fixes. Until Microsoft publishes its own advisory, he added, the safest assumption is that bugs such as CVE-2026-85045 remain unpatched in Edge.
A type confusion bug in V8 tricks the engine into treating one kind of data as another. That confusion is often a first step toward running arbitrary code inside the browser. Chrome and Edge share the same underlying engine, so a patch in one browser is normally a strong signal the other needs it too. The missing Microsoft advisory leaves administrators guessing rather than confirming.
Three separate deadlines now sit on administrators’ calendars because of this record Microsoft Patch Tuesday. Adobe Commerce needs patching by September 11. The two Microsoft zero-days need patching by September 22. The Chrome-derived Edge flaw has no fixed date at all, because Microsoft still hasn’t published the advisory that would set one.