Future TechnologyMicrosoft patched 974 flaws in one day. Only two were being exploited.
Key takeaways
- Microsoft closed 974 CVEs on 8 September 2026, more than double the 421 record set in August
- Two are actively exploited: CVE-2026-85880 in Windows ALPC and CVE-2026-81963 in the Windows Update Stack, both local privilege escalation to SYSTEM
- Both are in CISA's Known Exploited Vulnerabilities catalog, with a 22 September deadline for federal civilian agencies
- Around 20 of the fixes are potentially wormable and 58 more are rated more likely to be exploited, so triage by exposure rather than by raw count
Microsoft closed 974 CVEs on 8 September 2026, more than double the 421 it patched in August. That August figure was itself a record, set four weeks earlier.
Two of the 974 are being exploited in the wild right now. That ratio, rather than the headline number, is the useful part of this release.
The two that are already being used
CVE-2026-85880 is a heap buffer overflow in the Windows Advanced Local Procedure Call subsystem. A local attacker who already has a foothold can use it to escalate to SYSTEM.
CVE-2026-81963 is an improper link resolution flaw, the class usually described as link following, in the Windows Update Stack. The components that install updates can be tricked into acting on a path the attacker controls. The outcome is the same: local privilege escalation to SYSTEM.
Neither gives an attacker initial access. Both are the second stage of an intrusion, which is why they show up in real campaigns rather than in scanner noise.
CISA has added both to the Known Exploited Vulnerabilities catalog. Federal civilian executive branch agencies have until 22 September 2026 to patch. That deadline is a reasonable benchmark for everyone else.
Nobody agrees on the number
BleepingComputer counted 966 flaws. Ars Technica counted 972, with 112 rated Critical. The Register, Dark Reading and CyberScoop all landed on 974. Senserva's own risk ranking puts the total at 1,169.
The spread is not sloppiness. Vendors tally bundled CVEs and third-party components differently. Chromium fixes that reach Edge, for example, are counted by some outlets and excluded by others, and a single advisory covering several affected products can be counted once or several times.
For patch planning the discrepancy does not matter. For anyone tracking month-on-month trend lines, it does, because a 3 percent counting difference is small against a 130 percent jump but large against a normal month.
Why the count is climbing
Ars Technica attributes the rise to AI-assisted vulnerability discovery, the same explanation offered for August's 421. Automated fuzzing and model-assisted code review are surfacing bugs faster than the traditional research-to-patch cycle was built to absorb.
That pressure runs in both directions. The same tooling that helps Microsoft's internal teams and external researchers find flaws is available to people looking for them for other reasons.
It is worth being precise about what this does and does not imply. A record CVE count is evidence that discovery got faster. It is not evidence that Windows got worse, and Dark Reading and CyberScoop both note there has been no matching spike in active exploitation. Two exploited bugs out of 974 is a lower ratio than most months, not a higher one.
What to actually do this week
Start with the two KEV entries. Both need a local foothold, so the exposure that matters is any machine where a non-administrative user can run code: shared workstations, jump boxes, developer laptops, terminal servers.
Next, the roughly 20 vulnerabilities flagged as potentially wormable. Wormable means the flaw can spread machine to machine without a person clicking anything, which changes the risk profile from an incident to an outage.
After that, the 58 Microsoft rates as more likely to be exploited. Microsoft's exploitability index is a prediction rather than a measurement, but it has been a reasonable filter historically and it is a better sort order than CVSS score alone.
Adobe shipped its own batch the same day. The Register flags those as needing attention alongside the Microsoft set, which is easy to miss when one vendor's release is soaking up all the coverage.
The number is not the news
A 974-CVE Patch Tuesday is a genuinely difficult operational event for anyone running a large Windows estate, and the honest reading is that this is now the shape of the problem rather than a one-off spike. August set a record, September doubled it, and the mechanism driving both is still accelerating.
The practical consequence is that patch triage stops being a list to work through and becomes a filtering exercise. Exposure, exploitability and blast radius are the three questions worth asking. Total count is not one of them.
