Microsoft’s September Patch Tuesday has turned patching into a numbers game, with nearly 1,000 vulnerabilities landing at once and two already being exploited.
Microsoft addressed 974 vulnerabilities in its September 2026 security update, making it the company’s largest Patch Tuesday release on record. Security researchers counted 119 critical vulnerabilities, with 723 entries affecting Windows components and 111 affecting Office products.
The surge follows several months of unusually large releases, including 570 vulnerabilities in July and 400 in August. Security researchers have suggested that Microsoft’s growing use of AI-assisted discovery tools may be contributing to the increase. But the size of the list is not the most important part.
Microsoft has classified two vulnerabilities as actively exploited: CVE-2026-81963, an elevation-of-privilege flaw in the Windows Update Stack, and CVE-2026-85880, a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC).
Security researchers said both flaws could ultimately allow attackers to obtain SYSTEM-level privileges.
Action1’s Jack Bicer told TechRepublic that CVE-2026-81963 can allow a low-privileged local attacker to gain SYSTEM privileges without user interaction. Mike Walters of Action1 said CVE-2026-85880 can let an attacker escape a low-privilege AppContainer and obtain SYSTEM privileges.
Cohesity’s Amol Sarwate, in a statement to TechRepublic, said the two vulnerabilities should be the first priority because attackers can use them to move from an existing foothold to deeper control of a Windows machine.
“In a record-setting Patch Tuesday of [974] fixes, top priority goes to the two actively exploited Windows flaws (CVE-2026-85880 and CVE-2026-81963),” Sarwate said.
More Microsoft news
The bigger enterprise risk
Security researchers identified 20 vulnerabilities as potentially wormable because they may allow unauthenticated attackers to remotely execute code without user interaction. One of the most concerning is CVE-2026-69730, a Windows DNS Server flaw with a CVSS score of 9.8.
Dustin Childs of Trend Micro’s Zero Day Initiative compared it with SigRed, the critical Windows DNS Server vulnerability disclosed in 2020.
“We haven’t seen a global worm in years, but with a DNS flaw acting as the spiritual successor to SigRed, that reality could change fast,” Childs told TechRepublic.
Other infrastructure targets include DHCP, Remote Desktop Services, Netlogon, NFS and Exchange Server. Exchange deserves particular attention because CVE-2026-55007 could allow remote code execution when a server processes a malicious Visio attachment. Exploitation requires sustained low-memory conditions, making an attack more difficult, but no user interaction is required after the attachment reaches the server.
Patch priority matters more than the headline number
For IT teams, the lesson from September’s release is not to chase 974 vulnerabilities equally.
Organizations should first patch or mitigate the two exploited zero-days, then prioritize exposed DNS, DHCP, Remote Desktop, Exchange, Netlogon and identity infrastructure. IT teams should use Microsoft’s advisories and their own asset inventories to rank the remaining Office and endpoint fixes by exposure and business criticality.
AI may be dramatically increasing the number of bugs defenders can fix, but organizations still have limited time and resources to deploy those fixes. This month’s combination of exploited zero-days and wormable flaws makes prioritization especially important.
Read more: AI could accelerate vulnerability discovery and shrink the supply of exploits governments rely on, intensifying the race between attackers and defenders.
