CyberNew CyberNew
Vulnerabilities & CVEs The Record 1 month ago

Microsoft posts nearly 1,000 bugs for Patch Tuesday as CISA warns two being exploited

CN
CyberNew Threat Research Desk
• Original Reporting: The Record
CyberNew Threat Intel Assessment
Assessed Severity: HIGH
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Vulnerabilities & CVEs

Analyst Takeaway

"Image: Angel Bena via Pexels Microsoft posts nearly 1,000 bugs for Patch Tuesday as CISA warns two being exploited Microsoft’s latest Patch Tuesday release broke another record this month, surpassing 900 vulnerabilities for the first time. The federal cyberdefense agency, CISA, confirmed that two of them — CVE-2026-81963 and CVE-2026-85880 — are being exploited by hackers. Federal agencies have..."

Recommended Defense & Mitigation

  • Access Review: Audit administrative roles, enforce phishing-resistant MFA, and review privilege escalations.
  • Credential Rotation: Rotate high-privilege service credentials and tokens associated with impacted services.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Microsoft sign
Image: Angel Bena via Pexels

Microsoft posts nearly 1,000 bugs for Patch Tuesday as CISA warns two being exploited

Microsoft’s latest Patch Tuesday release broke another record this month, surpassing 900 vulnerabilities for the first time.

The federal cyberdefense agency, CISA, confirmed that two of them — CVE-2026-81963 and CVE-2026-85880 — are being exploited by hackers. Federal agencies have until September 22 to patch them. 

Tenable’s Satnam Narang said CVE-2026-81963 relates to a component used to install Windows updates and CVE-2026-85880 affects a messaging system in Windows. More than 22,000 corporate Exchange servers are unpatched against weaponized exploit code, according to Nightwing cybersecurity expert Nick Carroll. 

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from The Record.

Primary Advisory →