Update, Oct. 25: Microsoft’s October Patch Tuesday broke this record again, fixing more than 1,400 vulnerabilities, with one Windows Shell flaw already under attack, according to BleepingComputer and other trackers. Our October coverage has the details.
Microsoft’s September 2026 Patch Tuesday fixed at least 974 security vulnerabilities, by far its biggest monthly release, and two of them were already being exploited in attacks.
The exact count depends on who is tallying. Krebs on Security, SecurityWeek, Dark Reading and Qualys put it at 974. The Zero Day Initiative’s Dustin Childs counted 972, Tenable 964, and BleepingComputer 966, because it leaves out 204 flaws Microsoft fixed earlier in the month in services such as Azure AI Language, Copilot Studio and Entra ID.
The previous monthly record was set only in July, when Microsoft patched at least 570 flaws. According to Ars Technica, Microsoft has fixed 2,760 vulnerabilities so far this year, more than double last year’s total, and at this pace it will finish 2026 with more fixes than 2023, 2024 and 2025 combined.
Microsoft says artificial intelligence is helping speed up the discovery of vulnerabilities, Krebs reported, and BleepingComputer tied the jump to Microsoft’s use of an AI-powered vulnerability discovery system. Microsoft isn’t alone. Krebs noted that Adobe, Cisco, Google, Mozilla and Oracle have also credited AI-assisted research with bigger, more frequent patch releases.
The two zero-days
CVE-2026-85880 is a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) component. “An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system. No additional user interaction is required,” Microsoft said in its advisory, as quoted by SecurityWeek. Tenable’s Satnam Narang told SecurityWeek it is only the second ALPC zero-day patched in nearly four years, after CVE-2023-21674 in January 2023.
CVE-2026-81963 is a link-following flaw in the Windows Update Stack that also lets a local attacker gain System privileges. Narang noted it is the first of the seven Update Stack flaws fixed over the past five years to be exploited as a zero-day. Both bugs carry a CVSS score of 7.8 and an Important rating, and Microsoft hasn’t said who is exploiting them or how widely.
What else stands out
Windows accounted for 723 of the flaws and Office for 222, including 111 in Office 2016, SecurityWeek reported. SQL Server had 62, Developer Tools 22, SharePoint Server 16, Azure 12, Skype for Business 10 and Exchange Server 9. Qualys rated 113 of the bugs critical and 860 important, while Dark Reading said Microsoft flagged 58 as more likely to be exploited because of factors such as low attack complexity and high impact.
By BleepingComputer’s breakdown, elevation-of-privilege bugs made up about 45% of the batch (438), remote code execution about 27% (258) and information disclosure about 18% (173), with denial of service, security feature bypass and spoofing making up the rest.
Childs found 20 flaws that could be considered wormable, meaning they allow remote code execution without authentication or user interaction. The one he is most worried about is CVE-2026-69730 in Windows DNS Server, which an unauthenticated attacker can exploit over the network. “We haven’t seen a global worm in years, but with a DNS [Domain Name System] flaw acting as the spiritual successor to SigRed, that reality could change fast,” he told Computer Weekly, referring to the wormable DNS bug found in 2020.
His other picks include CVE-2026-55007, an Exchange Server bug that lets a remote, unauthenticated attacker run code by sending an email with a malicious Visio attachment, and CVE-2026-80097, a privilege escalation in Microsoft Authenticator. “This is the worst type of privilege escalation as it uses a bug in the authentication system itself,” Childs said, per Ars Technica. Krebs also pointed to CVE-2026-69829, a critical Windows Shell remote code execution flaw with a CVSS score of 9.8.
Testing is the bottleneck
“Looking at nearly 1,000 vulnerabilities in a single month, all I can think is: ‘My God, it’s full of stars.’ AI-assisted bug discovery has exploded patch counts into a whole new galaxy, and defenders simply have to embrace the suck,” Childs told Computer Weekly. He also noted that exploitation hasn’t risen to match: “we have not seen a correlating spike in active exploits—yet,” he wrote, as quoted by Ars.
Narang made a similar point. “AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn’t finding more needles,” he told Krebs, adding that organizations need to work out which flaws actually apply to them and are reachable.
For enterprise admins, the hard part is testing before deployment, since not all third-party software copes with changes to Windows. “It’s time to put our CISOs and CSOs on notice,” Fortra’s Tyler Reguly told Krebs. “How are you helping your teams through these difficult times?” Jack Bicer, director of vulnerability research at Action1, told Computer Weekly that “the challenge is not simply getting through the patch list but knowing what needs attention first.”
Adobe shipped its own large update the same day, patching more than 170 vulnerabilities, including a zero-day in Adobe Commerce, according to SecurityWeek. Childs’ full September review lists the next Patch Tuesday for October 13.
WebProNews is an iEntry Publication