September Patch Tuesday brings 973 Microsoft CVEs (119 Critical), including two zero-days already under active exploitation (CVE-2026-85880 and CVE-2026-81963). That's on top of five other Microsoft CVEs and one Chrome zero-day exploited since August's release that are still worth checking off, since exposure windows remain for anyone who hasn't patched.