Microsoft's September Patch Tuesday fixes 974 vulnerabilities, its largest batch on record
With two flaws already exploited and 113 rated critical, the month is a lesson in ranking patches by exploitation rather than by count.
Microsoft released fixes for at least 974 security vulnerabilities on 8 September 2026, the largest single batch the company has ever issued, according to Krebs on Security. The previous record was 570 patches in July 2026, and the total for 2026 so far exceeds 2,600 with three months remaining, already well beyond the 1,245 patches Microsoft shipped across the whole of 2020.
Of the 974 flaws, 113 carry Microsoft's critical rating, meaning they could allow an attacker to take over a system with little or no user interaction. Two vulnerabilities are already being exploited: CVE-2026-81963 and CVE-2026-85880, both of which allow privilege escalation on Windows. Krebs also highlighted CVE-2026-69730, a flaw in the Windows DNS service affecting Windows Server 2012 and later plus Windows 10, which an unauthenticated attacker could trigger with specially crafted packets and which Microsoft assesses as likely to be exploited, and CVE-2026-69829, a remote code execution bug in Windows Shell rated 9.8 out of 10 that requires no privileges and no user interaction.
Microsoft attributes part of the surge to artificial intelligence speeding up vulnerability discovery. Krebs notes that Adobe, Cisco, Google, Mozilla and Oracle have made similar statements, suggesting the trend is industry-wide rather than specific to one vendor.
The reaction from security practitioners quoted in the piece focused on the burden of deployment. Tyler Reguly of Fortra said it was time to put chief information security officers and chief security officers on notice about the demands that weekend patching places on their teams. Satnam Narang of Tenable said AI-assisted discovery in 2026 is producing larger haystacks without finding more needles, a reference to the gap between the volume of reported flaws and the smaller number that attackers actually use.
Why it matters
Vulnerability discovery is now partly automated, and the number of fixes is growing faster than the number of people available to test and deploy them. That turns patching from a monthly chore into a prioritisation problem: which of nearly a thousand fixes deserve an emergency change window, and which can wait for the regular cycle. The two exploited flaws and the handful of critical, low-complexity bugs are this month's answer to that question. Organisations without a repeatable way to rank patches will fall further behind with each cycle.
Vulnerability discovery is now partly automated, and the number of fixes is growing faster than the number of people available to test and deploy them.
- Vulnerabilities patched974
- Previous monthly record (July 2026)570
- Rated critical113
- Actively exploited2
Figures: Figures reported by Krebs on Security from Microsoft's September 2026 release
What you can learn from this
CVSS scores measure severity, not likelihood of attack. The Common Vulnerability Scoring System rates how bad exploitation would be, using factors such as attack complexity, privileges required and user interaction. A 9.8 means an attacker needs no account and no click and gains broad control, which is why CVE-2026-69829 stands out. But a high score does not mean anyone is exploiting the flaw, and a lower-scored bug that is being actively used can be more urgent. Ranking by score alone is a common mistake.
Actively exploited is the signal that changes priorities. When a vendor confirms in-the-wild exploitation, the question is no longer whether an attack is possible but whether you are already exposed. Microsoft's exploitability index, published alongside each release, is a separate assessment from the severity rating and flags bugs it expects attackers to pick up next. Combining the two produces a far shorter list than 974. This is the basis for risk-based vulnerability management and for the known-exploited-vulnerabilities catalogue maintained by the US cybersecurity agency CISA.
Privilege escalation flaws are chained, not used alone. CVE-2026-81963 and CVE-2026-85880 let an attacker who already has a foothold as an ordinary user gain higher privileges. On their own they do not provide initial access, which is why they usually appear alongside phishing or a separate remote code execution bug. Attackers value them because most defences assume a low-privileged account can do limited damage. Patching them removes the step that turns a minor compromise into a full one.
Unauthenticated network-facing bugs deserve first attention. The DNS flaw can be triggered by packets sent to the service without logging in, and DNS servers by design accept traffic from many clients. Any vulnerability a remote party can reach without credentials and without user action is wormable in principle, meaning it could spread automatically between machines. This combination of exposure and low complexity is why such bugs are often patched out of cycle. Reducing which services are reachable from untrusted networks limits the blast radius even before the patch lands.
Testing capacity is the real bottleneck. A patch can break applications, drivers or scripts, so organisations stage updates through test rings before broad deployment. When the volume of fixes rises, the time available to test each one falls unless the process is automated. This is the human-intensive work the practitioners quoted were describing. Automated deployment rings, snapshot-based rollback and clear ownership of each application are what make a thousand-patch month survivable.
We teach this
How to use this in practice
Build a prioritisation table for this month's release. Open Microsoft's Security Update Guide, filter to September 2026, and export the list. Add columns for exploited (yes or no), exploitability assessment, CVSS score, whether the affected component is network-facing, and whether it exists on any system you administer. Sort by exploited first, then exploitability, then score. Done looks like a spreadsheet whose top ten rows are the ones you would patch this week.
Check the patch state of one machine you control. On a Windows PC, open Settings, then Windows Update, then update history; or run
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10in PowerShell to list recently installed updates. Confirm whether the September cumulative update is present, and if it is not, note whether the machine is set to defer updates or has simply not restarted. Done looks like a note of the installed KB number, the date it landed, and the reason for any gap.Map which services on a machine are reachable without credentials. Run
netstat -anoon Windows orss -tlnpon Linux to list listening ports, then identify what each one is and whether it needs to be exposed. Cross-check the list against the network-facing vulnerabilities in this month's release, paying particular attention to anything on port 53 given the DNS flaw. Done looks like a list of listening services with a keep, restrict or remove decision beside each, and one firewall rule tightened if you found something unnecessary.Draw a patch pipeline diagram with a rollback path. Sketch the stages: vendor release, triage, test ring, pilot group, broad deployment, verification, rollback. Mark where a decision is made and who makes it, and add a fast lane for exploited vulnerabilities that skips the usual waiting period between rings. Done looks like a flow diagram you could hand to someone new to explain how a fix travels from Microsoft to a desktop safely.
Sources
- Microsoft Plugs Nearly 1,000 Security Holes — Krebs on Security
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report