Microsoft Delivers Largest Monthly Patch Batch in History
Microsoft Corp. issued updates today to address at least 974 security vulnerabilities across its Windows operating systems and other software products, marking the company’s largest single patch release to date. This September Patch Tuesday update surpasses the previous record set in July 2026, when Microsoft addressed 570 flaws, and brings the year-to-date total to over 2,600 patched vulnerabilities — more than double the 1,245 fixes released throughout all of 2020 — with three months still remaining in the year.
Two Actively Exploited Zero-Day Vulnerabilities Patched
Among the updates are two zero-day flaws currently being exploited in the wild: CVE-2026-81963 and CVE-2026-85880. Both vulnerabilities allow attackers to elevate privileges on Windows systems. Microsoft confirmed these flaws are under active attack, making their inclusion in this month’s update particularly urgent for defenders.
Over 100 Critical Flaws Addressed, Including High-Risk DNS and Shell Bugs
A total of 113 of the vulnerabilities patched this month received Microsoft’s ‘critical’ severity rating, indicating they could be exploited by malware or attackers to gain full control of a vulnerable Windows machine with minimal or no user interaction.
One of the most concerning critical flaws is CVE-2026-69730, a DNS vulnerability affecting Windows Server 2012 and later, as well as Windows 10. Microsoft warns that an unauthenticated attacker could exploit this flaw by sending a specially crafted network packet to an unpatched system, and assesses that exploitation is likely.
Another high-risk issue is CVE-2026-69829, a critical remote code execution vulnerability in the Windows Shell. This flaw carries a CVSS base score of 9.8 out of 10 and can be exploited with low attack complexity, requiring no privileges and no user interaction, making it especially dangerous if left unpatched.
AI Accelerates Vulnerability Discovery, But Deployment Challenges Remain
Microsoft attributes part of the surge in vulnerability identification to artificial intelligence, which is helping researchers uncover flaws at an accelerated pace. However, security experts caution that while AI is increasing the volume of detected issues, many organizations are struggling to keep up with the operational burden of testing and deploying such large volumes of patches monthly.
Tyler Reguly, associate director of security research and development at Fortra, emphasized the human challenge behind patch management: ‘It’s time to put our CISOs and CSOs on notice,’ he said. ‘How are you helping your teams through these difficult times? Do you have your teams deploy after hours and on weekends to avoid disruption to the business environment? Do you reward them for that effort? Time to dig into your budget and buy dinner for your teams that are working on Saturday to get patches rolled out before users return to work on Monday.’
Context Matters: Not All Flaws Pose Equal Risk
Satnam Narang, senior staff research engineer at Tenable, offered a balancing perspective: while the number of patched vulnerabilities is rising due to AI-assisted discovery, the subset of flaws that actually impact most organizations remains relatively small.
‘AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn’t finding more needles,’ Narang said. ‘It’s critical that organizations understand which vulnerabilities actually apply to them, whether they pose a threat by being reachable and exploitable, and prioritize remediation based on this risk context.’
Practical Guidance for Users and Administrators
For individual Windows users, the advice remains consistent: regularly check Windows Update or accept prompts to install pending patches. Given the growing size of monthly updates, delaying installation increases risk over time.
Enterprise administrators are encouraged to monitor trusted sources such as askwoody.com for reports of problematic updates and consult the SANS Internet Storm Center for detailed, severity-based breakdowns of each month’s patch release to inform prioritization and testing efforts.
Source: Krebs on Security