966 fixes in one day, and two of the holes were already in use
The number is most of the story. Microsoft's September Patch Tuesday, out on 8 September, covers 966 flaws by BleepingComputer's count and 964 by Tenable's, depending on where you draw the line around cloud services. Either way it is the biggest single release the company has ever put out, with 105 entries rated Critical. A count like that says more about how vulnerabilities get found now, with automated tooling sifting through code at scale, than about Windows suddenly falling apart. Almost none of the 966 will ever be touched by anyone.
Two of them already have been. CVE-2026-81963 sits in the Windows Update stack itself, the machinery that installs updates, and lets a program already running on your PC climb to SYSTEM, the account with total control. It affects Windows 11 and Server 2025, and was reported by Romain Deperne together with Microsoft's own threat intelligence team. CVE-2026-85880 is a heap overflow in Advanced Local Procedure Call, the pathway Windows components use to talk to each other, and it hits Windows 10 and older server versions. Volexity's Mark Kelly and Proofpoint's David Galazin and Jeremy Hedges found that one. Both carry a severity score of 7.8, Microsoft has not said who was using them, and CISA added both to its known-exploited catalogue on 8 September.
One other flaw is worth mentioning purely so you can stop worrying about it. CVE-2026-69730 scores 9.8 and researchers are calling it the spiritual successor to SigRed, the wormable DNS bug from 2020. It lives in Windows DNS Server, a role that runs on company servers. No home PC has it installed.
What you want on your machine: KB5124008 for Windows 11 24H2 and 25H2, KB5122880 for 23H2, and KB5122878 for Windows 10 PCs on extended security updates. The release also carries Critical remote code execution fixes across Word, Excel, Outlook and PowerPoint, plus the graphics and codec components that open images for you. A download this size is exactly where Windows Update tends to stall, and if yours does, Tendvane's Windows Update repair wizard resets the plumbing underneath it so the install can start cleanly.