Microsoft security patches shatter record with 974 fixes in September

2 Min Read

Microsoft security patches set unprecedented scale

Microsoft Corp. released its September Microsoft security patches bundle, closing ↑ 974 vulnerabilities across Windows and related software – the largest single batch in the company’s history.

Zero‑day exploits among the fixes

Two actively exploited zero‑day flaws, CVE‑2026‑81963 and CVE‑2026‑85880, permit privilege escalation on Windows systems. Both are being weaponized in the wild.

Critical rating applies to 113 issues, meaning malware could seize control with minimal user interaction. Notable among them is CVE‑2026‑69730, a DNS flaw affecting Windows Server 2012 onward and Windows 10; an unauthenticated attacker can trigger it by sending a crafted packet.

“Organizations must triage relentlessly; the sheer volume overwhelms traditional testing cycles,” said Tyler Reguly, Fortra.

Another high‑severity bug, CVE‑2026‑69829, scores 9.8 on the CVSS scale, allowing remote code execution via the Windows Shell with no privileges required.

AI‑driven research is credited for the surge, a trend echoed by Adobe, Cisco, Google and Oracle, which report faster discovery cycles. Google recently announced bi‑weekly security releases (Reuters).

Security researchers caution that while the patch count climbs, the subset of vulnerabilities relevant to most enterprises remains limited. “AI is expanding the haystack, not necessarily the needles,” noted Satnam Narang of Tenable.

Enterprise IT teams face a mounting operational burden: each update must be validated against legacy applications before rollout. As Microsoft continues to amplify its patch cadence, administrators are urged to monitor community sites such as askwoody.com for emerging issues and consult the SANS Internet Storm Center for severity rankings.

Intel provided by Nova Stirling (Aerospace & Space Tech Correspondent).