Microsoft patches 974 CVEs in September Patch Tuesday

Microsoft's September 2026 security release covered 974 vulnerabilities, including 723 in Windows and 222 in Office, with 113 rated critical. Two flaws were already exploited, including the ALPC sandbox escape CVE-2026-85880, and 20 were rated wormable RCE. Adobe patched 172 CVEs the same month, including an exploited Magento zero-day.

• 974 CVEs in the release: 723 in Windows, 222 in Office, 113 critical
• Already exploited: CVE-2026-85880 (ALPC) and CVE-2026-81963 (Windows Update)
• 20 flaws rated wormable RCE, including DNS Server CVE-2026-69730
• Adobe patched 172 CVEs, including Magento zero-day CVE-2026-75650