All posts

September 2026 Windows Update — 974 Fixes, 2 Zero-Days, Install It Now

4 min read
Person sitting at a home office desk checking their laptop, blue screen glow on their face, evening lighting

Microsoft shipped 974 security fixes on 8 September. That is not a typo. Nearly a thousand vulnerabilities in a single update, smashing July's record of 570. A hundred and thirteen are rated Critical. Two are already being exploited. Install now, read on after.

974
vulnerabilities patched this month113 Critical (82 remote code execution), 2 actively exploited zero-days, roughly 20 wormable flaws that can spread with no human involvement. The largest single patch Microsoft has ever shipped.

The two zero-days

Both are privilege escalation. An attacker who already has a foothold on your machine can use either one to gain full SYSTEM access. Complete control.

2 zero-days, actively exploited

CVE-2026-81963: Windows Update Stack privilege escalation. Tricks the Windows Update mechanism into following a malicious file link. Gets full SYSTEM privileges. No user interaction needed once the attacker is on the machine.
CVE-2026-85880: Windows ALPC privilege escalation. A buffer overflow in Windows' inter-process communication. Lets an attacker running low-privilege code escape a sandboxed application and take over the system.

"Already on the machine" sounds less scary than remote code execution. But phishing emails, dodgy downloads and browser exploits hand out that initial foothold every single day. Don't sit on this one.

Three other flaws worth knowing

That Outlook flaw is the one I'd flag for home users. If your email client auto-previews the top message in your inbox, the exploit fires the second Outlook opens. You don't have to click a thing.

Why nearly a thousand?

AI-assisted vulnerability discovery. Security researchers are using tools that scan millions of lines of code for patterns humans would take weeks to spot. 2026's total is already past 2,600 CVEs, more than double any previous full year. July hit 570. September, 974.

Anything broken?

No widespread problems reported with this update so far. It also fixes some bugs from August: the mouse cursor customisation issue on non-English systems, random black desktop backgrounds, and Teams crashing on ARM laptops.

How to install

  1. Settings > Windows Update
  2. Check for updates
  3. Wait 10-30 minutes
  4. Restart when prompted, not two days later
Quick check: The Windows 11 cumulative this month is KB5124008 (24H2 and 25H2). Look in Update history to confirm it's installed.

Windows 10 (if you're still there)

This month's Windows 10 patch is KB5122878. You only get it through the free Extended Security Updates programme. See the Windows 10 end-of-life guide for how to enrol. Free ESU runs until October 2026. One month away.

If Windows Update itself is broken

A PC that can't update can't protect itself. The usual culprits are low disk space, corrupted update files, or another antivirus clashing with Defender. I've covered the fixes in my common PC problems post. If storage is the bottleneck, speeding up a slow Windows 11 PC has that covered too. If none of that works, computer repair in St Helens is what I do.

If you want the full technical breakdown, Bleeping Computer covers every CVE and Krebs on Security analyses which ones matter most.

Mark — Your Local Computer Guy
Mark

Mark has been fixing computers since the late '90s and went self-employed in 2008. Based in St Helens since 2013, he works evenings and weekends from his home in Laffak — friendly, affordable repairs for PCs, laptops, and Macs. See reviews on Google

Updates failing or something not right?

If Windows Update is stuck, your PC is running worse since you installed, or you're not sure you're protected — get in touch and I'll sort it.

★★★★★

"I cant fault this guy. Fit me in speedily and resolved the issue. Had another issue once I got home and he did fixed that too. Would defo use again."

— Melanie Atherton, via Google