Microsoft Corp. right now issued updates to plug no less than 974 safety holes in its Home windows working techniques and different software program, by far its greatest single patch batch ever. Microsoft says synthetic intelligence helps to hurry the invention of vulnerabilities, however safety consultants warn that many organizations already are struggling to prioritize the extra human-intensive endeavor of testing and deploying so many fixes every month.
Picture: Shutterstock.com, Kirill Makarov.
This month’s patch bundle obliterates the software program big’s earlier document set in July, when it launched updates for no less than 570 safety vulnerabilities. September’s Patch Tuesday brings this yr’s whole to greater than 2,600, greater than twice Microsoft’s earlier record-setting patch yr in 2020 (1,245) and with three extra months to go.
There are two “zero-day” flaws mounted this month which are being actively exploited: each CVE-2026-81963 and CVE-2026-85880 permit an attacker to raise their privileges on Home windows system.
Totally 113 of the bugs addressed right now earned Microsoft’s “important” score, which means they might be abused by malware or miscreants to grab management over a weak Home windows machine with little or no assist from the person.
Among the many extra critical important flaws this month is CVE-2026-69730, a DNS weak point current in Home windows Server 2012 onward and on Home windows 10. Microsoft warns that an unauthenticated attacker might leverage this weak point just by sending a specifically crafted packet to an affected system, and that it’s more likely to be exploited.
Additionally scary is CVE-2026-69829, a important, distant code execution flaw within the Home windows Shell. This vulnerability has a CVSS base rating of 9.8 (10 is essentially the most extreme), and could be exploited with low assault complexity, no privileges, and no person interplay.
Microsoft’s abstract of the safety updates launched right now. Picture: msrc.microsoft.com.
Microsoft is hardly alone in transport monster patch bundles currently. Many different massive software program corporations, together with Adobe, Cisco, Google, Mozilla and Oracle, all have lately credited AI-assisted analysis with growing their patch cadence and quantity (Google mentioned right now it’s now going to ship safety updates each two weeks).
Tyler Reguly, affiliate director of safety analysis and improvement at Fortra, mentioned one core problem with deploying Home windows updates is that they should be examined earlier than being put in throughout a corporation as a result of not all third-party software program works seamlessly within the face of modifications to the underlying working system.
“It’s time to place our CISOs and CSOs on discover,” Reguly mentioned. “How are you serving to your groups by way of these tough occasions? Do you’ve your groups deploy after hours and on weekends to keep away from disruption to the enterprise setting? Do you reward them for that effort? Time to dig into your funds and purchase dinner in your groups which are engaged on Saturday to get patches rolled out earlier than customers return to work on Monday.”
Satnam Narang is senior employees analysis engineer at Tenable. Narang mentioned it’s necessary to acknowledge that whereas the variety of vulnerabilities being patched by Microsoft is rising, the variety of flaws that may and can have an effect on most organizations stays fairly low.
“AI-assisted vulnerability discovery in 2026 is creating bigger haystacks, however it isn’t discovering extra needles,” he mentioned. “It’s important that organizations perceive which vulnerabilities really apply to them, whether or not they pose a risk by being reachable and exploitable, and prioritize remediation based mostly on this danger context.”
In fact, common Home windows customers don’t want to check patches earlier than deploying them, however they nonetheless have to open Home windows Replace periodically or else assent to this system’s nag notices about pending updates. And on the fee these Home windows patch releases are ballooning in measurement, it’s in all probability greatest to not allow them to pile up month after month.
Enterprise Home windows admins will need to keep watch over askwoody.com for information of any updates that look like inflicting issues. As at all times, the SANS Web Storm Heart has a per-patch breakdown ordered by severity and urgency.
