Microsoft broke its own Patch Tuesday record again this cycle, shipping fixes for somewhere between 964 and 974 CVEs depending on how third-party trackers count bundled Edge/Chromium and non-Windows components — Tenable puts it at 964, BleepingComputer at 966, SecurityWeek and Neowin at 974. Whatever the exact tally, it’s the largest single release Microsoft has ever shipped, with over 100 flaws rated Critical. Two of the bugs are confirmed zero-days already exploited in the wild.

The exploited zero-days

CVE-2026-81963 — Windows Update Stack elevation of privilege. An improper link-resolution (“link following”) flaw in the Windows Update Stack lets an attacker who already has local, low-privileged access escalate to SYSTEM. Seven Windows Update Stack EoP bugs have been patched since 2022; this is the first one Microsoft has confirmed was exploited as a zero-day before the patch shipped. Microsoft hasn’t disclosed how the in-the-wild attacks worked, only that DART or an equivalent internal team confirmed exploitation. Because the Update Stack runs with high trust on every managed Windows endpoint and server, this is a reliable local-privesc primitive for any attacker who has already landed a foothold — treat it as evidence of active post-exploitation activity, not theoretical risk.

CVE-2026-85880 — Windows ALPC elevation of privilege. A heap-based buffer overflow in Advanced Local Procedure Call, the IPC mechanism Windows uses for inter-process communication between user-mode and kernel-mode components. CVSS 7.8, “Important” per Microsoft’s own rating, but the exploitation history says otherwise: 16 ALPC vulnerabilities have been patched since 2022, and this is the first ALPC bug to appear in a Patch Tuesday release in over three years (the last was April 2023) and only the second confirmed exploited as a zero-day since January 2023. ALPC bugs have a long track record as reliable privilege-escalation chains (see: multiple PrintNightmare-adjacent LPE chains), and successful exploitation here hands an attacker SYSTEM.

Both are local-privilege-escalation, not remote code execution — meaning they’re most valuable to an attacker chained after initial access (phishing, a web-facing RCE, or a stolen low-priv credential). Patch domain controllers, jump boxes, and any server exposed to untrusted local users or containers first.

The CVSS 10.0 cloud-identity trio

Three unrelated flaws in Microsoft’s cloud identity and AI stack hit the maximum CVSS score this cycle, though none currently show evidence of active exploitation and all three were already mitigated server-side by Microsoft before disclosure — no client patching required, but worth auditing your configuration against:

  • CVE-2026-83711 — Azure Active Directory B2C. CWE-639, authorization bypass through a user-controlled key. An unauthenticated, unauthenticated-network attacker could elevate privileges with no user interaction — full compromise of confidentiality and integrity for affected B2C tenants. Microsoft fixed this at the service level; B2C tenant admins should still verify custom policy configurations match their intended trust boundaries, since the underlying design pattern (trusting a client-supplied key/claim for authorization decisions) is one teams can reintroduce in custom policies even after Microsoft’s platform-level fix.
  • CVE-2026-80098 — Copilot Studio. Improper verification of a cryptographic signature, CVSS 9.3, elevation of privilege.
  • Azure AI Language Authoring — a separate CVSS 10.0 authentication-bypass EoP, network-exploitable with low complexity and no user interaction.

The pattern across all three: cloud-hosted identity and AI services where a signature or key-verification step could be bypassed over the network. None require customer action beyond reviewing tenant configuration, but they’re a reminder that “the vendor patched it server-side” doesn’t mean the exposure window is zero — these were live, unauthenticated, full-compromise bugs in production multi-tenant services for some period before disclosure.

What to do now

Prioritize CVE-2026-81963 and CVE-2026-85880 on every Windows Server and workstation image — both are confirmed exploited, and Update Stack/ALPC exist on essentially every supported Windows build. Roll them into your fastest patch ring rather than a normal Patch Tuesday cadence. For Azure AD B2C and Copilot Studio tenants, no patch action is required, but pull your custom policy and connector configurations and confirm you aren’t independently trusting client-supplied claims for authorization decisions — the underlying bug class (CWE-639) is one your own integrations can reproduce even on a patched platform. As always with a record-setting release, expect proof-of-concept code for the higher-profile CVEs within days; treat the LPE zero-days as immediate-patch items rather than next-maintenance-window items.

References: Help Net Security’s Patch Tuesday roundup, Tenable’s analysis of CVE-2026-81963 and CVE-2026-85880, BleepingComputer’s coverage, SecurityWeek’s report, and MSRC advisories for CVE-2026-81963, CVE-2026-85880, and CVE-2026-83711.