If you thought last month's Patch Tuesday was a lot to handle, September 2026 just rewrote the rulebook entirely.

Microsoft delivered a record number of patches to address 974 CVEs in its own products this month, including two bugs that Redmond says are already under exploitation.

To put that figure in context,

Microsoft released fixes for 974 unique vulnerabilities in its scheduled security update for September, which until recently would have represented a full year's worth of CVEs.

This isn't just a statistic for your monthly security report — it's a genuine operational emergency. With attackers already weaponising two zero-days and 20 more vulnerabilities classified as potentially wormable, every hour your team spends triaging without a clear plan is an hour attackers can exploit. Here's everything you need to know, and — more importantly — exactly what to do first.

How Did We Get Here? The AI-Fuelled Patch Explosion

The scale of September's release didn't emerge overnight.

September's record-breaking collection of security updates comes after Microsoft served up 421 fixes in August and 622 in July.

The cumulative trajectory is staggering:

September's Patch Tuesday brings this year's total to more than 2,600, more than twice Microsoft's previous record-setting patch year in 2020 (1,245) — and with three more months to go.

The driving force behind this surge is artificial intelligence.

Microsoft says advances in AI have significantly accelerated vulnerability discovery, allowing engineers to identify more security issues before they can be exploited in zero-day attacks. "The pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code, with new mechanisms that can accelerate both discovery and analysis," Microsoft said.

Specifically,

the company is using Microsoft Security's multi-model agentic scanning harness (MDASH), an AI-powered vulnerability discovery system which scans critical binaries and validates potential vulnerabilities using multiple AI models.

But the sheer volume is a double-edged sword.

Security experts warn that many organisations are already struggling to prioritise the more human-intensive endeavour of testing and deploying so many fixes each month.

The good news, as Tenable's Satnam Narang points out, is that

"while the number of vulnerabilities being patched is rising, the number of vulnerabilities that can and will affect most organisations remains quite low. AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn't finding more needles."

The Two Zero-Days You Must Patch Immediately

When nearly 1,000 CVEs land on your desk at once, the temptation is to panic. Don't. Start with the two vulnerabilities that attackers are actively exploiting right now.

CVE-2026-85880 — Windows ALPC Heap Buffer Overflow

The first exploited zero-day, CVE-2026-85880, is a heap buffer overflow issue in the Windows Advanced Local Procedure Call (ALPC) that could allow a local attacker to gain System privileges.

What makes this particularly nasty is the attack path:

"An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system," Redmond warned.

CVE-2026-81963 — Windows Update Stack Privilege Escalation

The second exploited flaw, CVE-2026-81963, affects the Windows Update Stack. It stems from improper handling of links before accessing a file, which can allow a local attacker with low privileges to gain SYSTEM privileges. Like the first flaw, the vulnerability carries a CVSS score of 7.8 and requires no user interaction.

Both bugs carry an "Important" severity rating — not "Critical" — which is a perfect illustration of why you cannot rely on Microsoft's severity labels alone.

Microsoft rates both vulnerabilities as Important rather than Critical, but their confirmed exploitation makes them higher priorities for patching.

CISA agrees:

CISA added both zero-days to its Known Exploited Vulnerabilities catalog on September 8 — one day before the patches were publicly released — setting a September 22 remediation deadline for federal civilian agencies.

Private-sector teams should apply the same urgency.

The Wormable Threat You Can't Afford to Overlook

Beyond the two active zero-days, the September release contains a cluster of vulnerabilities that keep enterprise security architects up at night.

The record-breaking September security update fixes two exploited privilege-escalation zero-days and 20 potentially wormable vulnerabilities.

The most alarming of these is CVE-2026-69730.

CVE-2026-69730 is a Critical RCE vulnerability in Windows DNS Server with a CVSS score of 9.8. An unauthenticated attacker can send a specially crafted packet to the DNS service and execute code on the target system. No user interaction is required.

The reason this is so dangerous in enterprise environments is the co-location problem:

in most Active Directory environments, DNS runs on domain controllers themselves rather than on dedicated infrastructure. A successful exploit against an AD-integrated DNS server can deliver code execution on a domain controller. Similar DNS service flaws have historically drawn rapid attention from both ransomware operators and nation-state actors because of this co-location pattern.

Security researchers are drawing explicit comparisons to history's most destructive network worms.

CVE-2026-69730 is described by ZDI's Dustin Childs as the spiritual successor to SigRed (CVE-2020-1350), the critical DNS Server flaw that required emergency patching in 2020. Historically, wormable flaws like SigRed have proved particularly dangerous because they don't require user interaction, spread automatically, and target core network infrastructure like DNS Server.

The full wormable cluster affects components including DHCP Server, Active Directory, Windows DNS Server, SMB Client, Netlogon, NFS, RRAS, IP Helper, Message Queuing, and others.

What Else Needs Attention: The Broader Vulnerability Landscape

Overall, Microsoft rolled out patches for 723 flaws in Windows and fixed 222 security bugs in its Office suite, including 111 in Office 2016.

Multiple security issues were also addressed in SQL (62), Developer Tools (22), SharePoint Server (16), Azure (12), Skype for Business (10), and Exchange Server (9).

Several non-zero-day vulnerabilities demand elevated attention from security teams:

Exchange Server CVE-2026-55007 is a standout, with an attack path involving an email carrying a malicious Visio attachment that Exchange content indexing processes without user interaction. You don't need a user to click — the server does the dangerous work.

CVE-2026-69525 is a Remote Desktop Services RCE with a CVSS score of 9.8, highlighted by ZDI as allowing remote, unauthenticated attackers to run arbitrary code on affected systems via a use-after-free bug.

The release includes 22 Critical Office-related vulnerabilities, including 12 that can be triggered just by previewing malicious content.

Researchers from Action1 highlighted three near-maximum severity (CVSS 9.8) RCE bugs: CVE-2026-69829, an RCE in Windows Shell; CVE-2026-69595, an RCE in Windows Services for NFS ONCRPC XDR Driver; and CVE-2026-78510, a Microsoft Word RCE.

The "Exploit Wednesday" Reality — Why Speed Matters

There's a dangerous window that opens the moment Microsoft publishes its patches.

For every patch Microsoft releases, attackers race to reverse-engineer the update to find the underlying vulnerability and develop an exploit for unpatched systems — a phenomenon often referred to as "Exploit Wednesday."

Once a patch is out, attackers pick it apart in an attempt to reverse-engineer the holes it plugs and then race to break into machines that have not yet been updated. Defenders and third-party trackers must now piece together the full picture from underlying advisory feeds themselves and figure out what needs to be patched first.

This is why the old model of 30-day or quarterly patching cycles is no longer viable. As one expert bluntly noted,

"attack groups will do things like hold their first attack until the day after Patch Tuesday, because it puts Microsoft on the spot." "So if you are waiting for 30-day or quarterly cycles to patch, you are behind the curve."

Practical Tips: How to Prioritise 974 CVEs Right Now

The number 974 is attention-grabbing, but

security teams shouldn't respond by treating 974 vulnerabilities as 974 equally urgent problems. They're not.

Here's a clear, actionable framework:

1. Patch the two active zero-days first — today.

Start by deploying the September 2026 Microsoft security updates for the two exploited zero-days, CVE-2026-85880 and CVE-2026-81963.

These are being exploited in the wild right now.

2. Treat the DNS Server flaw as a zero-day.

If you run Windows DNS Server, treat CVE-2026-69730 as a zero-day even though it is not one yet.

Given its CVSS 9.8 score and co-location with domain controllers, the risk of exploitation is imminent.

3. Prioritise domain controllers and internet-facing servers.

The prioritisation framework is clear: active zero-days first, then wormable network services, then internet-facing enterprise applications.

Patch your domain controllers before your file servers this month.

4. Don't rely on severity labels alone.

Both active zero-days are elevation-of-privilege vulnerabilities rated "Important," which reinforces why exploit status should take priority over severity labels alone.

Cross-reference the CISA KEV catalogue and exploit likelihood ratings.

5. Map CVEs to your actual environment.

Integration with asset inventory is critical; vulnerability data must be mapped to actual systems in the environment to determine true exposure. Without this mapping, teams risk focusing on vulnerabilities that do not exist in their infrastructure.

6. Use phased rollout rings.

A phased rollout can help teams move quickly on the most exposed systems while testing broader updates before organisation-wide deployment.

Automate where possible to keep pace with volume.

7. Verify patch success — don't assume it.

Sending an update does not prove that every device is protected. Systems may be offline, installations may fail, or endpoints may miss a deployment window. IT teams need to see which devices remain vulnerable, which patches succeeded, which failed, and which systems require another deployment attempt.

8. Shrink your attack surface in parallel.

Pull admin interfaces, legacy appliances, and unpatched on-prem Exchange servers off the public internet

while patching is underway. Reducing exposure buys you critical time.

Conclusion: The Era of Continuous Patching Has Arrived

September 2026's Patch Tuesday isn't an anomaly — it's the new normal.

Researchers from Nightwing declared: "We are officially moving past the traditional 'Patch Tuesday' approach and entering an era of continuous, high-volume security updates" and continuous patching.

As AI-powered vulnerability discovery accelerates on both sides of the security fence, organisations that cling to legacy patch management workflows will find themselves perpetually exposed.

The organisations that survive and thrive in this environment will be those that invest in robust, automated patch management platforms, risk-based vulnerability prioritisation, and real-time asset visibility.

As Tenable's Narang advises, "it's critical that organisations understand which vulnerabilities actually apply to them, whether they pose a threat by being reachable and exploitable, and prioritise remediation based on this risk context."

Don't let the volume paralyse you — let it sharpen your prioritisation strategy. Review your patch management process today, assess your exposure to this month's critical CVEs, and ensure your most internet-facing and business-critical systems are protected before attackers capitalise on Exploit Wednesday. If your current tooling can't keep up with nearly 1,000 patches a month, now is the time to evaluate platforms built for exactly this challenge.