What this means for you — Security leader:Patch the two actively exploited Windows and Chrome zero-days (CVE-2026-85880, CVE-2026-85046, CVE-2026-87491) and the remaining 996 CVEs today. Enterprises running on-prem Windows or self-hosted Chrome should prioritize the BlueMoon exploit-kit chain.
What this means for you — Lean IT orgs:Update all Windows PCs and Chrome browsers today. Most of the 999 vulnerabilities will be fixed automatically if you use Windows Update and Chrome's built-in updater; the two zero-days are already being exploited in the wild.
What this means for you — MSP:Deploy Microsoft's September 2026 patches across all client estates immediately; the two chained Windows + Chrome zero-days are already in active exploit kits used by espionage groups. Verify both OS and browser updates landed on every endpoint.
What this means for you — Researcher:Microsoft published 974 CVEs (723 in Windows) plus 25 third-party, for a total of 999. Three are confirmed exploited zero-days chained together in the BlueMoon kit and fake-website campaigns reported by Volexity.