Microsoft's Record Patch Tuesday: 974 Flaws, Two Already Exploited

Microsoft shipped security updates for a record 974 vulnerabilities on September 8, 2026, the largest single Patch Tuesday in the company's history. Two of the flaws were already being exploited in the wild before a fix existed, and 113 of the bugs earned Microsoft's "critical" severity rating. The release touches nearly every corner of the stack: Windows, Office, Exchange Server, SharePoint, SQL Server, Hyper-V, Visual Studio and the company's cloud services.

Related reading: Microsoft's October 2026 Patch Tuesday Sets a Record With 1,407 Fixes · Microsoft's August Patch Tuesday Fixed About 400 Flaws, and One Real Fire.

For defenders, the headline number is both alarming and misleading. The genuinely urgent work this month comes down to a small set of flaws, the two exploited zero-days, a handful of critical remote code execution bugs, and a wormable set that security researchers count at around 20. The rest is a prioritisation problem that grows more acute every month, driven largely by AI-assisted vulnerability discovery.

The two flaws already under attack

Both actively exploited vulnerabilities are privilege-escalation bugs that let an attacker climb to SYSTEM level, and Microsoft has shared few details about either.

The first, CVE-2026-85880, is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC). Microsoft's advisory says an attacker who can execute code in a low-privilege AppContainer could use the bug to escape the sandbox and elevate privileges, adding that "No additional user interaction is required." CISA added it to its Known Exploited Vulnerabilities catalog and gave federal agencies until September 22 to patch it. It is only the second ALPC zero-day Microsoft has had to fix since January 2023.

The second, CVE-2026-81963, is an improper link resolution ("link following") flaw in the Windows Update Stack, the component that installs updates. It is the first Update Stack flaw in five years that Microsoft has confirmed is being exploited. Both bugs were credited to outside researchers as well as Microsoft's own teams, and both grant SYSTEM-level access.

Zero Day Initiative researcher Dustin Childs warned that CVE-2026-81963 is likely "being combined with a code execution bug to spread malware or ransomware," and advised users to "Patch this one quickly."

Where the 974 come from

Microsoft's release notes and Qualys's analysis break September's release into 438 elevation-of-privilege flaws, 253 remote code execution flaws, 173 information-disclosure flaws, 56 denial-of-service flaws, 19 security-feature-bypass flaws and 16 spoofing flaws. By product, SecurityWeek reports roughly 723 issues affect Windows, 222 affect Office (including 111 in Office 2016 alone), 62 SQL Server, 22 developer tools, 16 SharePoint Server, 12 Azure, 10 Skype for Business and nine Exchange Server.

That distribution tells you where the exposure sits. Remote code execution and elevation of privilege are the categories that matter most, and they dominate the release. The two exploited bugs fall into the second category, which is why they are dangerous mainly as a second stage after an attacker has gotten in.

Beyond the zero-days: Exchange, SharePoint and wormable bugs

Even setting the zero-days aside, September carries high-priority patches that demand scheduling rather than routine deployment.

The most important, according to Childs, is CVE-2026-55007, an Exchange Server remote code execution flaw. An unauthenticated attacker can trigger it by sending an email with a malicious Visio attachment; the code executes when the server processes the attachment during content indexing, with no user interaction. Microsoft says the bug is "difficult to reliably trigger," but Childs's rejoinder is blunt: "The attacker only needs to get it right once. Schedule your downtime and update your Exchange servers with haste." Microsoft also patched nine Exchange Server flaws in total this month.

Also flagged by researchers: CVE-2026-80097, a local privilege escalation in Microsoft Authenticator that Childs called the worst kind of escalation because it abuses the authentication system itself; CVE-2026-69465, one of roughly 17 distinct SharePoint vulnerabilities that enable remote code execution; and CVE-2026-65669, one of about 60 SQL Server privilege-escalation bugs that can be triggered through SQL Copilot. Ars Technica catalogued the highlights.

Childs counts 20 flaws this month that are "wormable", remotely exploitable without authentication or user interaction. Several carry a near-maximum CVSS score of 9.8, including bugs in Windows DNS Server, DHCP Server, Remote Desktop Services, the NFS driver and the Windows Shell. That class of flaw is what turns a monthly patch cycle into a genuine maintenance window rather than a checkbox.

The AI volume problem

The most important context for September's number is that it is not an aberration. Microsoft's monthly totals have exploded through 2026: from a then-record release of roughly 200 flaws in June, to about 570 in July, to roughly 400 in August, and now 974 in September. By Krebs on Security's count, September brings Microsoft's 2026 total to more than 2,600 flaws, more than double its previous full-year record of 1,245, set in 2020, with three months still to go.

Microsoft has been unusually direct about the cause. In a July blog post, executive vice president Pavan Davuluri told Windows users to expect "a higher volume of security updates included in each security release" because AI was speeding up the discovery of vulnerabilities. The company has deployed AI-powered discovery systems, and the results are visible in the patch counts.

The security industry is still arguing about what that means. Tenable's Satnam Narang offered the most-quoted framing of the month: "AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn't finding more needles." His point is that most of the 974 flaws will never matter to a given organisation, because they are not reachable or exploitable in that environment.

Childs draws a similar but more cautious conclusion. "AI-assisted vulnerability discovery shows no signs of slowing down," he wrote. "However, we have not seen a correlating spike in active exploits—yet."

The AI theme is not confined to vulnerability discovery. On the same day as Patch Tuesday, the Microsoft Edge team published a post describing how AI-assisted coding had driven a surge in the number of browser extensions submitted for review. The Register reported that the team admitted its review pipeline was "experiencing additional strain," and that its response was more automation of repeatable checks. It is the second Microsoft team in a month to say AI-generated output is outpacing its ability to handle it: the Exchange team had already delayed a Cumulative Update after AI-assisted discovery produced more bugs than it could process.

The operational reality of 974 patches

For most home users, the practical answer is the same as always: let Windows Update run. The bigger question is what enterprises do with a month that hands them nearly a thousand fixes at once.

Testing remains the bottleneck. Unlike consumers, enterprises cannot simply install updates and move on, because third-party software often breaks when the underlying operating system changes. Fortra's Tyler Reguly made that point pointedly: "It's time to put our CISOs and CSOs on notice... How are you helping your teams through these difficult times?" He noted that many admins will be patching after hours and on weekends to limit disruption, and suggested the fix involves "gift cards for extra coffee", a line that is funny mostly because it is true.

The emerging consensus among defenders is to stop treating Patch Tuesday as a single queue and start prioritising by reachability and exploitability rather than raw severity. The two exploited zero-days and the Exchange flaw go first; the rest are triaged against whether the affected service is actually exposed. Microsoft's exploitability ratings, built for a world of human researchers, have not kept pace with AI-driven discovery, and analysts have criticised the model's assumptions.

There are downstream consequences, too. As patch volumes have grown, Microsoft has moved away from the exhaustive per-CVE lists some defenders relied on and toward a summary table plus a "Notable CVEs" section, a change that makes third-party trackers more important, not less. The scale has also pushed other vendors to shift cadence: Google now ships Chrome security updates every two weeks, and Adobe has moved to twice-monthly bulletins.

Caveats and the counting problem

Anyone quoting a single number for September should do so carefully. Microsoft's release notes, the Zero Day Initiative, Qualys, The Register and Krebs on Security put the figure at 974. BleepingComputer counts 966 because it tallies only bugs Microsoft shipped on Patch Tuesday itself, excluding the 204 fixed earlier in September across Azure, Entra ID, Edge and other services. Ars Technica cites roughly 972. The range reflects genuine differences in what gets counted, not disagreement about the scale.

Two further caveats. First, not every flaw in the batch is remotely exploitable; a large share are local elevation-of-privilege bugs that require an attacker to already have a foothold. Second, the expected deluge of AI-assisted attacks has not yet arrived in force. The fear is asymmetric: the discovery side is already operating at machine speed, while the exploitation side, so far, is not.

What to watch

Three things will determine whether September is remembered as a record or as the new baseline.

First, whether exploitation follows the volume. If attackers begin weaponising AI-discovered flaws at scale, the case for faster patching becomes far more urgent. Childs's "yet" is doing a lot of work.

Second, whether Microsoft's triage and disclosure practices keep up. The company is already streamlining how much detail it publishes; the trade-off is that defenders depend more on aggregators and exposure data, which smaller teams may not have.

Third, whether regulators and enterprises adjust their patch windows. US federal agencies have a September 22 deadline for the two zero-days under CISA's binding directive, but most private organisations set their own timelines, and a monthly cycle built for a few hundred bugs looks increasingly strained at nearly a thousand.

The record is real, and so is the workload. For defenders, the job this month is not to patch 974 things. It is to find the handful that matter, and to have the rest on a schedule.

Cover image: Building 92 at Microsoft's Redmond headquarters, photographed by Coolcaesar (Wikimedia Commons), licensed under CC BY-SA 4.0; cropped to 16:9.