In short: On September 8, 2026, Microsoft released a record-breaking Patch Tuesday, fixing 974 vulnerabilities across Windows and its ecosystem — the largest single-month release ever. Two of them are actively exploited in the wild right now: CVE-2026-85880 (Windows ALPC, CVSS 7.8) and CVE-2026-81963 (Windows Update Stack), both delivering SYSTEM-level privilege escalation. CISA added both to its KEV catalogue on September 8; the federal deadline is September 22. The release also includes 20 wormable RCE flaws in Windows DNS Server that require no authentication and no user interaction.
What happened: a record-breaking patch release
Every second Tuesday of the month, Microsoft releases its Patch Tuesday — a consolidated security update for the entire Windows ecosystem. September 2026 broke every previous record: 974 CVEs closed across Windows, Office, Edge, .NET, Azure, Hyper-V, and other components. The previous record stood at around 600 CVEs in a single month.
Among the 974 CVEs, analysts at BleepingComputer, SecurityWeek, and Tenable simultaneously flagged two zero-days already exploited in real attacks. We track ongoing Windows and platform threats in the LiMP VPN news section.
Two exploited zero-days: ALPC and Windows Update Stack
CVE-2026-85880 — Windows ALPC (CVSS 7.8). The flaw resides in the Local Inter-Process Communication (ALPC) mechanism — Windows' internal message bus between processes. A heap buffer overflow allows a local process (or malicious code already running on the machine) to escalate privileges to SYSTEM — the highest level in Windows — granting full access to files, the registry, network adapters, and the ability to disable security software.
CVE-2026-81963 — Windows Update Stack (CVSS 7.8). Classified as improper link resolution, this flaw sits inside the component that applies Windows updates. An attacker with basic user rights can use a symbolic link to redirect an update operation onto an arbitrary file and inherit SYSTEM privileges. The irony: the vulnerability lives precisely where security patches are installed.
Both CVEs were added to the CISA Known Exploited Vulnerabilities (KEV) catalogue on September 8, 2026 — confirming real-world active exploitation, not just proof-of-concept. U.S. federal agencies are required to patch by September 22. The KEV list has become a de-facto benchmark for enterprise security teams globally.
Our LiMP VPN blog covers how timely OS patching, combined with network-layer encryption, forms a complete defence-in-depth strategy.
20 wormable DNS Server flaws
Separate from the zero-days, September's Patch Tuesday includes 20 Critical-rated vulnerabilities in Windows DNS Server, all labelled wormable. CVE-2026-62820 and CVE-2026-62817 are the most severe: unauthenticated Remote Code Execution (RCE) via a specially crafted DNS query, with no user interaction required.
Wormable means the vulnerability can self-propagate: once an attacker breaches one DNS server, the exploit can spread laterally to adjacent DNS servers across the corporate network — automatically, without a human triggering each hop. For organisations running Windows Server with the DNS role, this is the highest-priority item in the September release.
Encrypting outbound traffic through a VPN complements perimeter patching by preventing attackers who intercept network segments from reading or manipulating DNS queries in transit. See what LiMP VPN protects at the network layer.
What this means for regular users
For most home Windows users, the two zero-days are the most relevant risk. Both CVE-2026-85880 and CVE-2026-81963 require some prior foothold on the machine — typically delivered via a phishing email, a malicious file, or a drive-by download. Once a threat actor has basic execution rights, the exploit grants SYSTEM privileges: browser-stored passwords, session tokens, encryption keys, and the ability to install ransomware or spyware silently.
The wormable DNS flaws (CVE-2026-62820, CVE-2026-62817) primarily threaten corporate networks, Windows Server deployments, and small-business servers running DNS. Home computers not configured as DNS servers are not directly exposed to the wormable vector — but the other 954 CVEs in this release make patching mandatory regardless.
A key distinction: a VPN does not replace OS updates. Kernel-level vulnerabilities are exploited before traffic leaves the device, independent of whether a VPN tunnel is active. What a VPN does provide is protection for data already in transit — preventing your ISP or anyone on the same network from intercepting sessions. LiMP VPN plans start at $0.99/month.
How to protect yourself right now
1. Apply Windows updates immediately. Start menu → Settings → Windows Update → Check for updates. The September cumulative update closes all 974 CVEs including both exploited zero-days. A reboot is required — do not defer it.
2. Stay alert to phishing vectors. CVE-2026-85880 and CVE-2026-81963 require local execution. The standard delivery chain starts with a phishing link or malicious attachment. Treat unexpected emails with links or attachments as suspicious, even from known senders.
3. If you manage Windows DNS servers, this is an emergency-priority patch. CVE-2026-62820 and CVE-2026-62817 are unauthenticated wormable RCEs. Patch within 24 hours; if that is not possible, isolate DNS port 53 (UDP and TCP) from external-facing network segments using firewall rules as a temporary mitigation.
4. Enable automatic updates. Nine hundred and seventy-four CVEs in one month is a reminder that manual patch management at scale is unsustainable. Use WSUS, Microsoft Endpoint Manager, or group policies to automate critical update delivery across your fleet.