# Microsoft's September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

DevFeed: [Microsoft's September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)](<https://devfeed.tech/articles/microsoft-s-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880-8267.md>)

Original publisher: [Read original article](<https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880>)

Author: Research Special Operations

Published: 2026-09-08T18:07:55Z

Content type: news

Language: en

Sources: [Tenable Blog](<https://devfeed.tech/sources/tenable-blog.md>)

Topics: [Microsoft](<https://devfeed.tech/topics/microsoft.md>), [cve-2026-85880](<https://devfeed.tech/topics/cve-2026-85880.md>), [.NET](<https://devfeed.tech/topics/net.md>), [ASP.NET](<https://devfeed.tech/topics/aspnet.md>), [GitHub Copilot](<https://devfeed.tech/topics/github-copilot.md>), [Visual Studio Code](<https://devfeed.tech/topics/visual-studio-code.md>), [OpenSSH](<https://devfeed.tech/topics/openssh.md>)

Tags: [asp-net-core](<https://devfeed.tech/tags/asp-net-core.md>), [cve-2026-81963](<https://devfeed.tech/tags/cve-2026-81963.md>), [cve-2026-85880](<https://devfeed.tech/tags/cve-2026-85880.md>), [github-copilot](<https://devfeed.tech/tags/github-copilot.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [net](<https://devfeed.tech/tags/net.md>), [openssh](<https://devfeed.tech/tags/openssh.md>), [patch-tuesday](<https://devfeed.tech/tags/patch-tuesday.md>), [security](<https://devfeed.tech/tags/security.md>), [september-2026](<https://devfeed.tech/tags/september-2026.md>), [update](<https://devfeed.tech/tags/update.md>), [updates](<https://devfeed.tech/tags/updates.md>), [visual-studio](<https://devfeed.tech/tags/visual-studio.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

Microsoft's September 2026 Patch Tuesday release addresses 964 CVEs, including two zero-days exploited in the wild. The release rates 104 vulnerabilities as critical and 860 as important.

## Source excerpt

104Critical 860Important 0Moderate 0Low Microsoft addresses 964 CVEs, smashing July's release as the largest Patch Tuesday release. This month's updates include patches for two zero-days that were exploited in the wild. Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 104 rated critical and 860 rated as important. This month's update includes patches for: .NET .NET and Visual Studio ASP.NET Core Active Directory Certificate Services (AD CS) Active Directory Domain Services Active Directory Federation Services (AD FS) Audio Video Control Transport Protocol Azure Arc Azure CycleCloud Azure HDInsights BranchCache Connected Devices Platform Service (Cdpsvc) Data Sharing Service Client GitHub Copilot and Visual Studio Code Graphic Fonts HID class driver IP Helper Internet Storage Name Service Kernel Streaming WOW Thunk Service Driver Microsoft Account Microsoft Authenticator Microsoft Azure Attestation service and Device Health Attestation Service Microsoft Azure CLI Microsoft COM for Windows Microsoft Dynamics 365 Microsoft Exchange Server Microsoft Graphics Component Microsoft Install Service Microsoft JScript Microsoft Local Security Authority Server (lsasrv) Microsoft Office Microsoft Office Access Microsoft Office Excel Microsoft Office Outlook Microsoft Office PowerPoint Microsoft Office Publisher Microsoft Office SharePoint Microsoft Office Word Microsoft Standard XPS Microsoft Teams for Android Microsoft Trace Data Helper Microsoft UxTheme Library (uxtheme.dll) Microsoft WDAC OLE DB provider for SQL Microsoft WebP Image Extension Microsoft Windows Codecs Library Microsoft Windows Media Foundation Microsoft Windows PDF Microsoft Windows SCSI Class System File Microsoft Windows Search Component Microsoft Windows Speech OpenSSH for Windows Power Automate Push Message Routing Service RPC Runtime Reliable Multicast Transport Driver (RMCAST) Remote Desktop Client Remote Desktop Gateway Service Role: DNS Server Role: Windows Fax Serv