Cyber & Technology — 2026-09-09

Microsoft Issues Record 974 Security Patches Including Two Actively Exploited Zero-Days

BLUFAI-assisted code scanning will very likely push Microsoft's monthly patch counts above 900 into Q4 2026, forcing CISOs to widen the gap between disclosed vulnerabilities and those they can realistically remediate on schedule.

Microsoft released patches for 974 vulnerabilities on Tuesday, its largest security update to date 12, though BleepingComputer's count of flaws issued specifically that day put the figure at 966 3. Two actively exploited zero-days were fixed: CVE-2026-81963, a Windows Update Stack flaw allowing privilege escalation to SYSTEM, and CVE-2026-85880, a Windows ALPC heap-overflow bug with the same effect. Both carry CVSS scores of 7.8, and Microsoft has not disclosed how they were exploited 23. Microsoft rated 113 of the flaws critical, according to Krebs on Security 4, while CyberScoop cited Microsoft's breakdown showing 723 vulnerabilities in Windows, 111 each in Office and Office 2016, 62 in SQL, and 22 in developer tools 2. The batch follows Microsoft's prior record of 570 flaws in July and 400 in August 3, and Tenable's Satnam Narang told Krebs and CyberScoop that AI-assisted discovery is expanding the volume of disclosed flaws without a corresponding rise in ones that pose real risk to most organizations 24.

Analysis
Microsoft's 974-flaw batch, its largest ever, strains enterprise patch-testing cycles more than it changes near-term risk: only two of the flaws saw active exploitation before disclosure, both privilege-escalation bugs Microsoft has not detailed. Enterprise remediation will concentrate on the two zero-days and the 113 critical-rated flaws, with the bulk of low-severity disclosures pushed past standard SLA windows through September. Microsoft's monthly Patch Tuesday disclosure count will very likely continue setting records into Q4 2026 as AI-assisted code scanning outpaces exploitation rates, widening the gap CISOs must manage between disclosed and actionable risk. Moderate confidence rests on the observable trend of consecutive record batches and Tenable's assessment of the AI-discovery acceleration, though Microsoft could tighten its disclosure criteria without warning.
4 sources
  1. Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days - SecurityWeek
  2. Microsoft discloses two actively exploited zero-days among 974 vulnerabilities - CyberScoop
  3. Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days - BleepingComputer
  4. Microsoft Plugs Nearly 1,000 Security Holes - Krebs on Security

View in full brief →

UNCLASSIFIED // OPEN SOURCE