Microsoft Ships Record 974 Patches Including Two Actively Exploited Zero-Days
Microsoft’s largest-ever Patch Tuesday addressed 974 flaws including two exploited zero-days. AI accelerates discovery but deployment friction and risk prioritization remain limiting factors. Evidence from MSRC and third-party telemetry indicates sustained high cadence through year-end.
The September batch surpasses July’s prior record of 570 flaws and brings 2026’s total past 2,600. One hundred thirteen bugs received critical ratings. CVE-2026-69730 permits unauthenticated remote code execution via crafted DNS packets against Windows Server 2012 and Windows 10; CVE-2026-69829 scores 9.8 CVSS and requires no user interaction or privileges. Contract awards and MSRC release notes confirm the volume spike correlates with expanded AI-assisted fuzzing pipelines rather than external researcher reports.
Microsoft: October 2026 Patch Tuesday will exceed 1,050 fixes if current AI discovery rate holds through end of September.
Sources (3)
- [1]Primary Source(https://krebsonsecurity.com/2026/09/microsoft-plugs-nearly-1000-security-holes/)
- [2]Supporting Source(https://msrc.microsoft.com/update-guide/)
- [3]Supporting Source(https://www.tenable.com/blog/microsoft-september-2026-patch-tuesday)