14 SEP 2026 — Microsoft fixed 974 vulnerabilities this month. That is the headline, and it is the wrong number to be alarmed about.
The number that matters is 2,760 — what Microsoft has patched so far in 2026, against a previous annual record of 1,139 set in 2025. The year is not finished. Whatever this is, it is not a bad month.
What September contains
Windows accounts for 723 of the 974, across client and server. Office contributes 222. The remainder is spread over SQL Server, SharePoint, Azure, Exchange, Skype for Business and the developer tools. A further 204 vulnerabilities in Azure, Entra ID and Edge were addressed earlier in the month and sit outside the Patch Tuesday count, which is one of the reasons totals differ between reports.
114 are rated critical. Twenty are described as wormable, affecting DHCP Server, Active Directory, Windows DNS Server, the SMB client, Netlogon, NFS, routing and remote access, IP Helper and Message Queuing — the services that talk to other machines without being asked to, which is what makes a flaw wormable in the first place.
Two are being exploited now. CVE-2026-85880 is a heap buffer overflow in the Windows Advanced Local Procedure Call, giving a local attacker SYSTEM. CVE-2026-81963 is an improper link resolution in the Windows Update stack, exploited after a user follows a malicious link. Both carry a modest CVSS of 7.8, and both matter more than that suggests, because a score describes the flaw rather than the position it hands over.
Why the annual figure is the story
Any single record month can be explained away as scheduling. Fixes cluster, an internal audit lands, a component gets a sweep, and the graph spikes for a month before settling. Defenders have absorbed that pattern many times.
A year running at 2.4 times the previous record resists that explanation. July came in at roughly 570, August at about 400 and September at 974, so what 2026 shows is an upward drift with a step change on top rather than one anomalous release. The Zero Day Initiative's Dustin Childs has suggested this may simply be the new normal, and the arithmetic supports him: 2,760 with a quarter of the year left means 2027 opens with a baseline nobody has staffed for.
The cause is not in dispute and is not sinister. Microsoft attributes the volume to AI-assisted code auditing. These are not new vulnerabilities being introduced. They are old ones being found, in code that has shipped for years, by tooling that reads faster than any review team.
Finding is not the bottleneck any more
The awkward part belongs to defenders rather than to Microsoft.
Automation has reached discovery and stopped there, leaving triage, testing and deployment where they were. An organisation that patches on a monthly cycle now receives, in a single drop, more changes than its test estate can validate before the next one arrives. The constraint has moved from finding flaws to absorbing fixes, and AI-assisted auditing does nothing for the second half of that.
What follows is a queue that never empties. The practical consequence is not that a specific bug goes unpatched; it is that prioritisation stops being a judgement and becomes a lottery, because nobody can meaningfully read 974 advisories in a month. A CVSS score is a useful input to that judgement, and decomposing one into its metrics shows how much of a headline severity comes from reachability rather than impact — but a score cannot tell you which of a hundred critical flaws is reachable in your estate.
Exploitation has not followed volume
There has been no matching spike in active exploitation. That is the counterweight to a headline number built to alarm, and it holds.
Two exploited flaws in 974 is a lower proportion than the historical average, not a higher one. August's 400-odd carried one. The flaws being surfaced by automated auditing are overwhelmingly the difficult, unremarkable kind that nobody was going to weaponise — and finding them is a real security gain even when the volume is unwelcome.
That gap between discovery and exploitation is the thing to watch. If it closes — if attackers begin running the same class of tooling against the same code and turning findings into working exploits at comparable speed — the arithmetic of patching changes completely. Nothing in this month's data says that has happened.
What an organisation should actually change
Stop treating the monthly total as a workload estimate. It is not: 723 Windows fixes arrive in cumulative updates, and installing them is one action, not 723.
Read the exploited list first and the wormable list second. Twenty wormable flaws in server-side network services is the unusual content of this release. For anyone running Active Directory, DNS or DHCP on an internal network, those deserve an out-of-cycle look whatever the rest of the queue holds.
And accept that reading every advisory has stopped being possible. The organisations that will cope are the ones that already patch on a cadence rather than a judgement, because a cadence scales with volume and a judgement does not.
What would change this
The exploitation rate is measurable month by month rather than arguable, which makes it the first thing to track.
Microsoft may also change how it ships the volume. A monthly bundle of a thousand advisories is arguably the wrong delivery format for a world where AI finds flaws continuously, and a severity-tiered cadence would serve defenders better than the calendar does.
Then there is everybody else. This is visible at Microsoft because Microsoft publishes its numbers. Every large vendor has the same tooling available, and most do not report in a way that would show the same curve.
View author profile → · Editorial policy
