Microsoft Corp. right now issued updates to plug at the least 974 safety holes in its Home windows working techniques and different software program, by far its greatest single patch batch ever. Microsoft says synthetic intelligence helps to hurry the invention of vulnerabilities, however safety consultants warn that many organizations already are struggling to prioritize the extra human-intensive endeavor of testing and deploying so many fixes every month.
Picture: Shutterstock.com, Kirill Makarov.
This month’s patch bundle obliterates the software program big’s earlier document set in July, when it launched updates for at the least 570 safety vulnerabilities. September’s Patch Tuesday brings this yr’s complete to greater than 2,600, greater than twice Microsoft’s earlier record-setting patch yr in 2020 (1,245) and with three extra months to go.
There are two “zero-day” flaws fastened this month which are being actively exploited: each CVE-2026-81963 and CVE-2026-85880 permit an attacker to raise their privileges on Home windows system.
Totally 113 of the bugs addressed right now earned Microsoft’s “vital” score, that means they may very well be abused by malware or miscreants to grab management over a weak Home windows machine with little or no assist from the consumer.
Among the many extra critical vital flaws this month is CVE-2026-69730, a DNS weak point current in Home windows Server 2012 onward and on Home windows 10. Microsoft warns that an unauthenticated attacker may leverage this weak point just by sending a specifically crafted packet to an affected system, and that it’s prone to be exploited.
Additionally scary is CVE-2026-69829, a vital, distant code execution flaw within the Home windows Shell. This vulnerability has a CVSS base rating of 9.8 (10 is essentially the most extreme), and might be exploited with low assault complexity, no privileges, and no consumer interplay.
Microsoft’s abstract of the safety updates launched right now. Picture: msrc.microsoft.com.
Microsoft is hardly alone in transport monster patch bundles these days. Many different massive software program firms, together with Adobe, Cisco, Google, Mozilla and Oracle, all have not too long ago credited AI-assisted analysis with rising their patch cadence and quantity (Google stated right now it’s now going to ship safety updates each two weeks).
Tyler Reguly, affiliate director of safety analysis and growth at Fortra, stated one core problem with deploying Home windows updates is that they should be examined earlier than being put in throughout a company as a result of not all third-party software program works seamlessly within the face of modifications to the underlying working system.
“It’s time to place our CISOs and CSOs on discover,” Reguly stated. “How are you serving to your groups via these troublesome instances? Do you might have your groups deploy after hours and on weekends to keep away from disruption to the enterprise setting? Do you reward them for that effort? Time to dig into your price range and purchase dinner to your groups which are engaged on Saturday to get patches rolled out earlier than customers return to work on Monday.”
Satnam Narang is senior employees analysis engineer at Tenable. Narang stated it’s vital to acknowledge that whereas the variety of vulnerabilities being patched by Microsoft is rising, the variety of flaws that may and can have an effect on most organizations stays fairly low.
“AI-assisted vulnerability discovery in 2026 is creating bigger haystacks, however it isn’t discovering extra needles,” he stated. “It’s vital that organizations perceive which vulnerabilities truly apply to them, whether or not they pose a risk by being reachable and exploitable, and prioritize remediation primarily based on this danger context.”
In fact, common Home windows customers don’t want to check patches earlier than deploying them, however they nonetheless must open Home windows Replace periodically or else assent to this system’s nag notices about pending updates. And on the price these Home windows patch releases are ballooning in dimension, it’s in all probability greatest to not allow them to pile up month after month.
Enterprise Home windows admins will wish to keep watch over askwoody.com for information of any updates that look like inflicting issues. As at all times, the SANS Web Storm Middle has a per-patch breakdown ordered by severity and urgency.
