Microsoft's September Patch Tuesday Plugs 974 Holes — the Biggest Single Patch Bundle Microsoft Has Ever Shipped
Microsoft's September Patch Tuesday Plugs 974 Holes — the Biggest Single Patch Bundle Microsoft Has Ever Shipped
Microsoft's September 2026 Patch Tuesday closed 974 security vulnerabilities across Windows and the rest of the company's software portfolio — by a wide margin the largest single patch bundle the company has ever released, and one that pushes this year's running total past 2,600 flaws with three months still to go. The previous record was set in July 2026, when Microsoft patched 570 vulnerabilities in one cycle.
What's in the Bundle
Of the 974 fixes released this month, 113 earned Microsoft's "critical" rating — meaning they could be abused by malware or an attacker to take control of a vulnerable Windows machine with little or no help from the user. Among the most serious is CVE-2026-69730, a DNS weakness present in Windows Server 2012 onward and on Windows 10. Microsoft warns that an unauthenticated attacker can leverage the bug simply by sending a specially crafted packet to an affected system, and that exploitation is likely. Also notable is CVE-2026-69829, a critical remote code execution flaw in the Windows Shell with a CVSS base score of 9.8 — exploitable with low attack complexity, no privileges, and no user interaction.
Two of the September fixes are actively exploited "zero-day" vulnerabilities. CVE-2026-81963 and CVE-2026-85880 both allow an attacker to elevate their privileges on a Windows system. Privilege escalation alone rarely makes headlines, but a local EoP paired with any one of the 113 critical remote code execution bugs in the same cycle becomes a fast path from Internet-facing service to SYSTEM.
Why the Volume Keeps Climbing
Microsoft is not alone in shipping monster patch bundles — Adobe, Cisco, Google, Mozilla, and Oracle have all recently credited AI-assisted vulnerability research with growing patch cadence and volume. Google said this month it is moving to security updates every two weeks. The volume, however, is creating a new problem: defenders cannot keep up. Tyler Reguly, associate director of security research and development at Fortra, told Krebs on Security that patching Windows in 2026 has become a people problem as much as a tooling one — CISOs need to fund the after-hours and weekend work required to test and roll out changes that risk breaking third-party software.
Satnam Narang, senior staff research engineer at Tenable, drew the line defenders actually need: "AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn't finding more needles. It's critical that organizations understand which vulnerabilities actually apply to them, whether they pose a threat by being reachable and exploitable, and prioritize remediation based on this risk context." In other words, the 974 count is real, but the number of bugs an organization should actually be panicking about is small.
What Should You Do?
- Treat the two zero-days (CVE-2026-81963 and CVE-2026-85880) as the priority this week. Both are privilege escalation bugs already being exploited. Patch endpoints first, then servers. Verify the patch actually landed by checking the build numbers Microsoft lists in the advisories — the cumulative update does not always include the standalone EoP fix.
- Plan critical RCE deployments as a fire drill, not a checklist. CVE-2026-69730 (DNS unauth RCE) and CVE-2026-69829 (Windows Shell RCE, CVSS 9.8) are the two "low complexity, no user interaction" critical bugs in this cycle. Get them staged for weekend deployment if your change-window policy allows it.
- Build a "what applies to us" view before you chase the headline number. Use your asset inventory to map the 974 advisories down to the 30 to 80 that actually touch your environment. Patch those in priority order, not the bundle as a whole. Defender fatigue is now a primary attack surface.
- Fund your patch team like they are part of the security perimeter. If your patching window spans weekends and after-hours hours, those hours need a budget line. The September cycle is the new normal, not a peak.
The WAF Angle
The September Patch Tuesday numbers matter to WAF operators even if no Microsoft product sits in front of a customer request — because the most dangerous combinations cross product lines. A WAF running on Windows Server 2012+ (or on Windows 10 hosts you expose for management) is potentially reachable via CVE-2026-69730, the unauthenticated DNS packet bug. A web application running on IIS is potentially reachable via CVE-2026-69829, the Shell RCE. And any of the 113 critical RCEs in this cycle become "Internet-facing critical" the moment the affected Windows service is reachable behind your edge. The defensive move is to treat every Windows host in your request path — proxy, reverse proxy, management plane, logging tier — as a priority patch target on Patch Tuesday. The volume will keep growing; defenders who wait for the "important" bundle will be the ones who miss the one that mattered.
