Microsoft's record Patch Tuesday highlights limits of severity-first patching
Microsoft's September 8 Patch Tuesday release included 973 CVEs, with 113 rated Critical, making it the largest release on record. Two actively exploited flaws—CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows ALPC—were both rated Important rather than Critical. Both are local elevation-of-privilege vulnerabilities that allow low-privilege code to elevate to SYSTEM privileges, and both were added to CISA's Known Exploited Vulnerabilities catalog on September 8. Mandiant's M-Trends 2026 report estimates the 2025 mean time to exploit at negative seven days, while CrowdStrike's 2026 Global Threat Report states that average eCrime breakout time fell to 29 minutes in 2025, with the fastest observed breakout taking 27 seconds.
Continue in the app — vote & join in ➔