Two perfect scores in this Patch Tuesday need no action. The two being exploited score 7.8.

Microsoft's September updates landed this evening, and the two vulnerabilities that will lead tomorrow's coverage are the two that require you to do nothing at all.

What is actually being exploited

The headline, and the homework

Two flaws carry Exploited:Yes, and neither is glamorous.

CVE-2026-81963, in the Windows Update Stack, is a link-following bug. Microsoft's own answer to the question of what an attacker gains is direct: an attacker "could gain SYSTEM privileges".

CVE-2026-85880, in Windows Advanced Local Procedure Call, is a heap-based buffer overflow. Microsoft describes the route in terms that matter for anyone running untrusted code in a sandbox: "An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system. No additional user interaction is required."

Both score 7.8. Both are elevation of privilege rather than remote code execution, which is why they will be third or fourth in most write-ups. Both are flagged Customer Action Required: Yes.

Nothing this month is publicly disclosed. Zero. That is unusual and worth noting, because it means both of these were found in use rather than in a write-up.

The two perfect scores that need no work

The highest scores in the document are CVE-2026-70352 in Azure AI Language and CVE-2026-83711 in Azure Active Directory B2C. Both are 10.0.

Both also carry Customer Action Required: No, and Microsoft's explanation is in the CVRF verbatim:

"This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency."

Microsoft has issued CVEs for cloud service flaws since June 2024 whether or not a customer can act on them. It is a good practice, it makes the record complete, and it produces the same misreading every time: a perfect ten with Microsoft's name attached, reported without the sentence that says there is nothing to do.

The number, counted the way this site counts it

The September document contains 1,170 CVE records, and that figure will be reported tomorrow as the count of flaws fixed today. It is not, and the split matters.

973 of those numbers Microsoft assigned itself. The remaining 197 come from Chromium and the open source packages inside Azure Linux, which Microsoft reships under the same release and which nobody means by Patch Tuesday.

The 973 is the comparable figure, and it is the story we nearly missed. August was 420. September is more than twice that, and it is the largest month this site has counted.

Where the 973 Microsoft CVEs are concentrated

Component	CVEs	Note
Windows Biometric Service	64	All elevation of privilege, all rated Important
SQL Server	61	The largest non-Windows cluster
Microsoft Office Word	38	Document parsing
Windows DHCP Server	36	Network-facing service
Microsoft Office Excel	32	Document parsing
Windows NTFS	29	Filesystem
Windows Win32K	23	Kernel graphics, a long-running source
Microsoft Standard XPS	18	Document rendering

Four components account for 190 CVEs between them. Sixty-four distinct identifiers landing on the Windows Biometric Service in one month, every one an elevation of privilege rated Important, is not the shape of ordinary reporting. It is the shape of a single audit or fuzzing campaign against one component being published at once. We checked that cluster specifically rather than assume it, because a number that odd is usually a parsing fault. It is not: sixty-four distinct identifiers, no duplicates anywhere in the set.

The impact distribution says the same thing August did, only louder. 438 of the 973, some 45%, are elevation of privilege, against 258 remote code execution. The largest class in the release, and both of the flaws being exploited, are about what an attacker does once already inside.

What to do

The position

This is a quiet month wearing a loud number. Nothing is publicly disclosed, the highest scores were fixed before they were published, and the genuine work is two privilege escalations that a scanner will rank in the middle of a long list.

The useful habit is the same one this site keeps returning to: read the field that says whether you have to act, not the field that says how bad it could theoretically be. Microsoft publishes both. Only one of them is about you.