A record 974 Microsoft fixes turn Patch Tuesday into a sequencing job
Microsoft fixed 974 flaws in September and two were already under attack, but both need an attacker who is already on the machine, while the twenty bugs Dustin Childs classes as wormable need no login at all.
The Product Desk
What happened
- Microsoft's September Patch Tuesday fixes 974 security flaws across its products, according to the company's release notes.
- Attackers were already exploiting two of them before the patches landed on Tuesday, and Dustin Childs of the Zero Day Initiative, who reviews every monthly release, called the total a new record.
- Both exploited flaws raise privileges for an attacker who already has a foothold on the machine: one sits in the Windows Update Stack, the other in the Advanced Local Procedure Call component.
- Childs classed 20 of the fixes as wormable, needing no login and no user action, in core services including DHCP, DNS, Netlogon, Message Queuing and SMB.
Why it matters
- Who has to decide decision A team with no evidence of an intruder can defend putting the twenty no-precondition bugs ahead of the two flaws attackers are actually using, and that is the call this release forces in the first change window.
- What it limits constraint Microsoft's own severity field narrows 974 items to about one in nine and then stops helping, so whoever owns the rings has to sort on preconditions instead of on labels.
- Who's exposed exposure Until the Exchange fix is deployed, anyone who can send mail to the server can attempt code execution on it without an account, and an unreliable exploit only means the attacker needs more attempts.
- What it sets up precedent Microsoft was one of 105 signatories to an open letter warning that the window to fix flaws is closing before AI-enabled attackers get there, so October's queue has no obvious reason to be shorter than this one.
Next story · Leadership · 2d ago
Microsoft's October release of 1,407 CVEs tops 2020's full-year record by 146Confirmed23 publishers
The release gets split into rings, and somebody has to decide what goes into the first one. Microsoft's severity field does not settle it. More than 110 of the fixes carry the company's highest rating [8], about one item in nine [24], with no order inside the bucket. Two flaws are rated 9.8 out of 10, one in Outlook and one in Remote Desktop Services [15][16], and the same number sits on different work: the Outlook bug fires through the Preview Pane, so a person has to preview a message first [15].
Preconditions sort the queue better than scores do. Both exploited zero-days need an attacker who already has a foothold on the Windows machine [5]. The Exchange Server flaw needs no account at all, because the code runs when the server processes an email carrying a rigged Visio attachment [13]. The Authenticator flaw on Android needs a malicious app already on the phone and a user who completes a sign-in, which Childs called the "worst type of privilege escalation" because it abuses the authentication system itself [17]. Two questions do most of the work: does the attacker have to be inside already, and does a human have to do something.
That framing is also how the Update Stack bug shrinks. Childs doubts attackers have hijacked the update mechanism itself, and his more likely reading is that they pair the Update Stack flaw with a code execution bug to spread malware or ransomware; on both zero-days his advice is to patch quickly [12]. If the pairing is what makes the privilege escalation worth having, the code execution holes reachable without an account belong in the same maintenance window as the zero-day, and the Exchange bug is one of them [13].
The headline count depends on who is counting. Microsoft's notes list 974 of its own CVEs and republish 25 more from other vendors, while Childs counts 972 new ones, or 997 with the Chromium fixes that ship inside Edge [7]. That is a spread of 25 between the lowest and highest figure [27]. The monthly totals are steadier: roughly 570 in July's record release and about 620 in August [9], which puts September around 57 percent above August [25]. Against Ars Technica's year-to-date count of 2,760 [10], this one release is about 35 percent of the year [26].
Some of the volume reads like one tool pointed at one target. Windows DHCP Server alone has 36 fixes, and Childs suspects someone aimed a fuzzer at the way it parses network packets, probably with AI help [20]. The Windows Biometric Service has 64, of which 56 are the same kind of heap overflow, "one bug class, stamped 56 times" in his words [21]. Those two components account for 100 fixes, roughly a tenth of the release [28]. Childs opened his review with a phrase from his military days, "embrace the suck" [1], and warned that "AI-assisted vulnerability discovery shows no signs of slowing down" [2]. Among more than 60 SQL Server fixes is one in SQL Copilot: crafted instructions submitted to the assistant inside SQL Server Management Studio reach the database with the user's permissions [22].
One workable ordering has three rings. Ring one is anything that needs neither an account nor a human, which is the 20 wormable bugs in DHCP, DNS, Netlogon, Message Queuing and SMB [18] plus Exchange. Ring two is the two zero-days and the rest of the local privilege escalations. Ring three is everything that waits on a user previewing a message or tapping through a sign-in. For an estate with no sign of an intruder, that puts the flaws attackers are already using behind the ones that travel on their own, and it puts domain controllers at the front, because the Kerberos flaw lets any domain user run code with one crafted request and Microsoft rates it as more likely to be exploited [19].
What to watch
- Any public detail on who is exploiting the Update Stack and ALPC zero-days, and at what scale, which would move them up the queue.
- October's count, and whether the fuzzer-heavy components such as DHCP Server and the Biometric Service keep producing at this rate.
- A reported in-the-wild chain that pairs the Update Stack privilege escalation with a code execution bug, as Childs expects.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence74
- Adoption58
- Hype gap+14
- Incentives60
- Confidence71
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Childs opened his review with a phrase from his military days: "embrace the suck."
- [2]
Childs warned that "AI-assisted vulnerability discovery shows no signs of slowing down."
- [3]
Microsoft's September Patch Tuesday fixes 974 security flaws across its products, according to the company's release notes.
- [4]
Attackers were already exploiting two of the flaws before the patches landed on Tuesday.
- [5]
Both zero-days let an attacker who already has a foothold on a Windows machine gain higher privileges; one sits in the Windows Update Stack (CVE-2026-81963), the other in the Advanced Local Procedure Call component (CVE-2026-85880).
- [6]
Dustin Childs of the Zero Day Initiative, who reviews every monthly release, called it a new record.
- [7]
Microsoft's notes list 974 of its own CVEs and republish 25 more from other vendors; Childs counts 972 new ones, or 997 if fixes for Chromium, the Google engine inside Edge, are added.
- [8]
More than 110 of the flaws are rated critical, Microsoft's highest severity level.
- [9]
Microsoft fixed roughly 570 flaws in July's record release and about 620 in August.
- [10]
By Ars Technica's count, Microsoft has now fixed 2,760 flaws this year, more than double last year's total.
- [11]
There is no public detail yet on who is exploiting the two zero-days or how widely, as Dan Goodin reported for Ars Technica.
- [12]
Childs doubts attackers have hijacked the update mechanism itself; his more likely reading is that attackers pair the Update Stack bug with a code execution flaw, a combination that can spread malware or ransomware, and his advice on both zero-days is to patch quickly.
- [13]
Exchange Server flaw CVE-2026-55007 lets an attacker with no login run code on a mail server by sending an email with a rigged Visio attachment; the code runs when the server processes the message, so nobody has to open anything.
- [14]
Microsoft rates the Exchange exploit as unreliable, and Childs points out that an attacker only needs it to work once.
- [15]
Outlook flaw CVE-2026-78509, rated 9.8 out of 10, can be triggered through the Preview Pane, and the victim only has to preview a message.
- [16]
Remote Desktop Services carries another flaw rated 9.8, CVE-2026-69525.
- [17]
Microsoft Authenticator for Android flaw CVE-2026-80097 requires a malicious app on the phone to trick the user into completing a sign-in, after which the attacker takes the user's tokens; Childs called it the "worst type of privilege escalation" because it abuses the authentication system itself.
- [18]
Childs classed 20 of the bugs as wormable: they need no login and no user action, and they sit in core services such as DHCP, DNS, Netlogon, Message Queuing and SMB.
- [19]
On domain controllers, Kerberos flaw CVE-2026-69676 would let any domain user run code with one crafted request, and Microsoft rates it as more likely to be exploited.
- [20]
Windows DHCP Server alone has 36 fixes, and Childs suspects someone aimed a fuzzer at the way it parses network packets, probably with AI help.
- [21]
The Windows Biometric Service has 64 fixes, and 56 are the same kind of heap overflow, which Childs described as "one bug class, stamped 56 times".
- [22]
Among more than 60 SQL Server fixes is CVE-2026-65669, which works by persuading a user to submit crafted instructions to SQL Copilot, the AI assistant in SQL Server Management Studio; if that succeeds the attacker reaches the database with the user's permissions.
- [23]
Two weeks ago OpenAI, Anthropic, Amazon Web Services, Google, Microsoft and 100 other companies and organisations published an open letter warning that the window to fix flaws is closing before AI-enabled attackers exploit them first.
- [24]
More than 110 critical ratings out of 974 flaws is about 11 percent, or roughly one item in nine.
- [25]
September's 974 fixes are about 57 percent above August's total of roughly 620.
- [26]
September's 974 fixes are about 35 percent of the 2,760 flaws Microsoft has fixed this year on Ars Technica's count.
- [27]
The lowest and highest counts of the release, Childs's 972 new CVEs and his 997 including Chromium, are 25 apart.
- [28]
Windows DHCP Server's 36 fixes and the Windows Biometric Service's 64 total 100, about a tenth of the 974 flaws in the release.
- [29]
The open letter had 105 signatories: OpenAI, Anthropic, Amazon Web Services, Google, Microsoft and 100 other companies and organisations.
Sources
2 independent publishers whose own reporting we read for this story.
- techradar.comMicrosoft September 2026 Patch Tuesday fixes nearly a thousand flaws, including two major zero-days | TechRadar
1 article · September 9, 2026
- thenextweb.comMicrosoft patches a record 974 flaws, and two are already under attack
1 article · September 10, 2026
Topics and entities
Topics
- Vulnerability Disclosure Regulation
- AI-Assisted Vulnerability Discovery
- Patch Tuesday
- Windows enterprise security
- Zero-Day Exploitation