Microsoft Fixes 966 Flaws in Record Patch Tuesday as 2 Zero-Days Face Active Exploitation
Updated
Updated · BleepingComputer · Sep 8
Microsoft Fixes 966 Flaws in Record Patch Tuesday as 2 Zero-Days Face Active Exploitation
3 articles · Updated · BleepingComputer · Sep 8
Summary
966 vulnerabilities were patched in Microsoft's September Patch Tuesday, the company's largest-ever security release, including two zero-days already exploited in attacks.
105 flaws were rated Critical, led by 81 remote-code-execution bugs; the broader tally included 438 elevation-of-privilege issues and 258 RCE vulnerabilities.
The two exploited zero-days both let attackers gain SYSTEM privileges locally—one in Windows Update Stack through improper link resolution, the other in Windows ALPC through a heap-based buffer overflow.
Microsoft did not disclose how either zero-day was used in the wild, but credited researchers from MSTIC, Volexity, Proofpoint and Romain Deperne.
The surge from 570 flaws fixed in July and 400 in August follows Microsoft's rollout of AI-powered vulnerability discovery, increasing pressure on customers to test and deploy patches faster.