# 974 CVEs in One Month: Mapping the Windows Patch Surface With Internet-Wide Data Microsoft's September 2026 Patch Tuesday fixed 974 CVEs, including two exploited zero-days (CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in ALPC). Vulnerability management teams usually read such releases as internal work queues. Internet asset mapping adds a second, external view: which Windows-exposed services sit on public IPs, which of them leak version information, and how the patch backlog translates into a measurable external footprint. ## From patch counts to external footprint A Windows server missing September's fixes does not advertise the fact, but the services it runs often do. RDP, SMB, IIS, Exchange OWA, and remote access components all expose version and configuration signals that mapping platforms index. The useful question for a team facing 974 fixes is not "how many CVEs affect us" but "which of our systems present an external face that maps onto the exploited or wormable subset." September's release included 438 elevation-of-privilege issues, 257 remote code execution issues, and 20 wormable-class vulnerabilities. The EoP bugs mostly matter after a foothold exists. The RCE and wormable subset maps directly onto external exposure: an internet-reachable system running affected remote access components is a different risk object from an internal workstation with the same patch level. ## Three mapping queries that operationalize the queue 1. Enumerate external RDP and remote access surfaces per organization or per ASN, so the exploited zero-day triage (both September zero-days are local, post-compromise bugs) gets paired with exposure triage of the remote-facing services where an RCE foothold starts. 2. Index Exchange OWA and other webmail surfaces separately. The September bulletin included a Critical Exchange RCE triggered via a Visio file over email, and OWA instances visible from the internet are the population where that path opens first. 3. Verify post-patch disappearance: after deployment, external banners and service versions shift, and mapping data can confirm the external footprint shrank, complementing internal patch compliance reports. Mapping platforms such as ZoomEye support these query patterns through product, service, and version fingerprints (https://www.zoomeye.org/). ## What mapping cannot do External fingerprinting does not see patch levels behind firewalls, and version banners lag the underlying build in cloud and containerized deployments. The two zero-days are local privilege escalations, which mapping cannot detect at all; they require internal inventory. The honest division of labor: internal tools own patch state, mapping owns the external face, and the queue priority comes from joining the two. ## Limitations This article synthesizes published September 2026 advisories and media reporting. No live mapping queries were executed for publication in this piece; the query channel was unavailable at writing time. Counts and CVE designations come from the cited sources. ## References * Microsoft MSRC September 2026 release notes (msrc.microsoft.com/update-guide/releaseNote/2026-Sep) * FreeBuf coverage of the record Patch Tuesday, September 9, 2026 * Huawei Cloud advisory summary, September 9, 2026

https://www.osintinvestigate.com A Chinese-linked threat actor known as UTA0565 has been observed exploiting a Chrome-Windows zero-day chain to deliver CLEANGULP malware. The attacks, detected on September 3 and 4, 2026, combined two Google Chrome vulnerabilities and a Windows ALPC flaw to escape the browser sandbox and achieve remote code execution. The campaign used phishing emails, fake websites, hidden iframes, and impersonated media organizations and NGOs to deceive targeted victims. In this episode, we examine how the BlueMoon exploit chain was used, how CLEANGULP operates, and why the reuse of the same exploit kit across multiple threat actors is attracting attention from cybersecurity researchers.

Chinese hackers used a combined Chrome and Windows zero-day chain to execute remote code.

Aujourd’hui de plus en plus d’enfants sourds se trouvent dans la nécessité d’apprendre la langue anglaise, comme leurs petits camarades entendants.Michel FRANÇOIS, parent de deux enfants sourds et pro...

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Proofpoint says four state-aligned clusters adopted the BlueMoon exploit chain within a week.

Microsoft, Windows 11 kullanıcıları için yayımladığı eylül ayı güncellemesiyle toplam 974 güvenlik açığını kapattığını açıkladı. Kapatılan açıklar arasında en dikkat çekici olanı, sistemde hâlihazırda siber saldırı amacıyla kullanıldığı doğrulanan CVE-2026-85880 kodlu güvenlik açığı oldu. Düşük yetkili bir AppContainer ortamında kod çalıştırabilen saldırganların, Windows Gelişmiş Yerel Prosedür Çağrısı (ALPC) üzerindeki yığın bellek taşmasından yararlanarak korumalı alandan kaçmasına imkân tanıyan bu açık, yetkilerin doğrudan "SYSTEM" seviyesine çıkarılmasına yol açıyordu.

Con 974 CVE corrette, quasi il doppio del record di luglio, il Patch Tuesday di settembre 2026 è il più grande della storia. Ma la vera notizia non è il numero: sono le due zero-day già sfruttate su ALPC e Windows Update Stack, venti vulnerabilità wormable e un Exchange che esegue codice remoto leggendo allegati Visio

Microsoftは2026年9月8日（米国時間）、Windows 11向けの月例更新プログラム「KB5124008」の提供を開始した。今月は約1000件という過去最大規模の脆弱性が修正されており、その中には既に悪用が確認されている「Windows Updateスタック」と「ALPC」の2件の権限昇格の脆弱性が含まれる。また、タスクバーを画面の上下左右に配置できる機能の復活や［スタート］メニューの...

Като част от ежемесечната си инициатива Patch Tuesday, Microsoft отстрани рекордните 974 уязвимости в своите софтуерни продукти, включително две от типа „нулев ден“, които са били експлоатирани в реални условия. Първата експлоатирана уязвимост от типа „нулев ден“, CVE-2026-85880 представлява проблем с препълване на буфера в Windows Advanced Local Procedure Call (ALPC), който би могъл да позволи на локален атакуващ да придобие системни привилегии. Втората уязвимост от типа „нулев ден“, CVE-2026-81963 представлява дефект при неправилно разрешаване на връзки преди достъп до файлове („следване на връзки“) в Windows Update Stack – компонентите, използвани за инсталиране на актуализации на Windows.

Microsoft's September 2026 Patch Tuesday is its largest ever, fixing 966 flaws and two actively exploited zero-days, CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows ALPC. The update spans major products including Windows, Office, SQL Server, Exchange Server, Entra ID, Azure services, and Microsoft Edge, with 105 Critical vulnerabilities addressed overall. #WindowsUpdateStack #WindowsALPC #EntraID #MicrosoftExchangeServer #MicrosoftOffice #SQLServer #MicrosoftEdge

Microsoft’s September 2026 Patch Tuesday addresses a record 974 CVEs, including two zero-days in Windows ALPC and the Windows Update Stack that can let local attackers gain SYSTEM privileges. The update also fixes major flaws in Exchange Server, SharePoint, SQL Server, Remote Desktop Services, and other Microsoft products, with several issues...

Two actively exploited Windows elevation-of-privilege flaws among 973 Microsoft CVEs.