# Microsoft fixes 974 flaws, including two exploited Windows zero-days

_Tuesday, September 8, 2026 at 3:20 PM EDT · Security · Latest · Tier 1 — Major_

![Microsoft fixes 974 flaws, including two exploited Windows zero-days — Primary](https://www.securityweek.com/wp-content/uploads/2023/12/Microsoft-Security-leaders.jpg)

Microsoft released patches for 974 CVEs across its products, including two Windows zero-days reported as exploited in the wild.

One is an ALPC heap-buffer-overflow flaw that can let a local attacker escape a low-privilege AppContainer and gain System privileges; the other affects the Windows Update Stack and also permits local elevation. The release includes 723 Windows flaws and 222 Office bugs. Researchers cited in the report said 20 resolved issues could be wormable, enabling remote code execution without authentication or user interaction.

## Sources

- [SecurityWeek](https://www.securityweek.com/microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days/)

---
Canonical: https://techandbusiness.org/newswire/RXVESHP1vcceDIfxIA21X0
Retrieved: 2026-09-08T23:49:53.486Z
Publisher: Tech & Business (techandbusiness.org)