Microsoft Plugs Nearly 1,000 Security Holes
Summary
Microsoft issued over 974 security patches, including critical zero-day vulnerabilities, marking its largest single patch batch to date, with AI aiding in faster vulnerability discovery.
<p><strong>Microsoft Corp.</strong> today issued updates to plug at least 974 security holes in its <strong>Windows</strong> operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and deploying so many fixes each month.</p>
<div id="attachment_74285" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-74285" decoding="async" class=" wp-image-74285" src="https://krebsonsecurity.com/wp-content/uploads/2026/09/shutterstock_278764853.jpg" alt="" width="750" height="498" srcset="https://krebsonsecurity.com/wp-content/uploads/2026/09/shutterstock_278764853.jpg 1000w, https://krebsonsecurity.com/wp-content/uploads/2026/09/shutterstock_278764853-768x510.jpg 768w, https://krebsonsecurity.com/wp-content/uploads/2026/09/shutterstock_278764853-782x519.jpg 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-74285" class="wp-caption-text">Image: Shutterstock.com, Kirill Makarov.</p></div>
<p>This month’s patch bundle obliterates the software giant’s <a href="https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/" target="_blank" rel="noopener">previous record set in July</a>, when it released updates for at least 570 security vulnerabilities. September’s Patch Tuesday brings this year’s total to more than 2,600, more than twice Microsoft’s previous record-setting patch year in 2020 (1,245) and with three more months to go.</p>
<p>There are two “zero-day” flaws fixed this month that are being actively exploited: both <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-81963" target="_blank" rel="noopener">CVE-2026-81963</a> and <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-85880" target="_blank" rel="noopener">CVE-2026-85880</a> allow an attacker to elevate their privileges on Windows system.</p>
<p>Fully 113 of the bugs addressed today earned Microsoft’s “critical” rating, meaning they could be abused by malware or miscreants to seize control over a vulnerable Windows machine with little or no help from the user.<span id="more-74277"></span></p>
<p>Among the more serious critical flaws this month is <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-69730" target="_blank" rel="noopener">CVE-2026-69730</a>, a DNS weakness present in Windows Server 2012 onward and on Windows 10. Microsoft warns that an unauthenticated attacker could leverage this weakness simply by sending a specially crafted packet to an affected system, and that it is likely to be exploited.</p>
<p>Also scary is <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-69829" target="_blank" rel="noopener">CVE-2026-69829</a>, a critical, remote code execution flaw in the Windows Shell. This vulnerability has a CVSS base score of 9.8 (10 is the most severe), and can be exploited with low attack complexity, no privileges, and no user interaction.</p>
<div id="attachment_74289" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-74289" decoding="async" loading="lazy" class=" wp-image-74289" src="https://krebsonsecurity.com/wp-content/uploads/2026/09/msrc-sug-sept2026.png" alt="" width="750" height="539" srcset="https://krebsonsecurity.com/wp-content/uploads/2026/09/msrc-sug-sept2026.png 906w, https://krebsonsecurity.com/wp-content/uploads/2026/09/msrc-sug-sept2026-768x552.png 768w, https://krebsonsecurity.com/wp-content/uploads/2026/09/msrc-sug-sept2026-782x562.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-74289" class="wp-caption-text">Microsoft’s summary of the security updates released today. Image: msrc.microsoft.com.</p></div>
<p>Microsoft is hardly alone in shipping monster patch bundles lately. Many other large software companies, including Adobe, Cisco, Google, Mozilla and Oracle, all have recently credited AI-assisted research with increasing their patch cadence and volume (Google said today it is now going to ship security updates every two weeks).</p>
<p><strong>Tyler Reguly</strong>, associate director of security research and development at <strong>Fortra</strong>, said one core challenge with deploying Windows updates is that they need to be tested before being installed across an organization because not all third-party software works seamlessly in the face of changes to the underlying operating system.</p>
<p>“It’s time to put our CISOs and CSOs on notice,” Reguly said. “How are you helping your teams through these difficult times? Do you have your teams deploy after hours and on weekends to avoid disruption to the business environment? Do you reward them for that effort? Time to dig into your budget and buy dinner for your teams that are working on Saturday to get patches rolled out before users return to work on Monday.”</p>
<p><strong>Satnam Narang</strong> is senior staff research engineer at <strong>Tenable</strong>. Narang said it’s important to recognize that while the number of vulnerabilities being patched by Microsoft is rising, the number of flaws that can and will affect most organizations remains quite low.</p>
<p>“AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn’t finding more needles,” he said. “It’s critical that organizations understand which vulnerabilities actually apply to them, whether they pose a threat by being reachable and exploitable, and prioritize remediation based on this risk context.”</p>
<p>Of course, regular Windows users don’t need to test patches before deploying them, but they still need to open Windows Update periodically or else assent to the program’s nag notices about pending updates. And at the rate these Windows patch releases are ballooning in size, it’s probably best not to let them pile up month after month.</p>
<p>Enterprise Windows admins will want to keep an eye on <a href="https://www.askwoody.com/2026/september-2026-windows-updates-are-released/" target="_blank" rel="noopener">askwoody.com</a> for news of any updates that appear to be causing problems. As always, the <strong>SANS Internet Storm Center</strong> has <a href="https://isc.sans.edu/diary/September%202026%20Microsoft%20Patch%20Tuesday/33320" target="_blank" rel="noopener">a per-patch breakdown</a> ordered by severity and urgency.</p>
View Cached Full Text
Cached at: 09/09/26, 12:08 AM
# Microsoft Plugs Nearly 1,000 Security Holes – Krebs on Security
Source: [https://krebsonsecurity.com/2026/09/microsoft-plugs-nearly-1000-security-holes/](https://krebsonsecurity.com/2026/09/microsoft-plugs-nearly-1000-security-holes/)
**Microsoft Corp\.**today issued updates to plug at least 974 security holes in its**Windows**operating systems and other software, by far its biggest single patch batch ever\. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human\-intensive endeavor of testing and deploying so many fixes each month\.
Image: Shutterstock\.com, Kirill Makarov\.
This month’s patch bundle obliterates the software giant’s[previous record set in July](https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/), when it released updates for at least 570 security vulnerabilities\. September’s Patch Tuesday brings this year’s total to more than 2,600, more than twice Microsoft’s previous record\-setting patch year in 2020 \(1,245\) and with three more months to go\.
There are two “zero\-day” flaws fixed this month that are being actively exploited: both[CVE\-2026\-81963](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-81963)and[CVE\-2026\-85880](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-85880)allow an attacker to elevate their privileges on Windows system\.
Fully 113 of the bugs addressed today earned Microsoft’s “critical” rating, meaning they could be abused by malware or miscreants to seize control over a vulnerable Windows machine with little or no help from the user\.
Among the more serious critical flaws this month is[CVE\-2026\-69730](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-69730), a DNS weakness present in Windows Server 2012 onward and on Windows 10\. Microsoft warns that an unauthenticated attacker could leverage this weakness simply by sending a specially crafted packet to an affected system, and that it is likely to be exploited\.
Also scary is[CVE\-2026\-69829](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-69829), a critical, remote code execution flaw in the Windows Shell\. This vulnerability has a CVSS base score of 9\.8 \(10 is the most severe\), and can be exploited with low attack complexity, no privileges, and no user interaction\.
Microsoft’s summary of the security updates released today\. Image: msrc\.microsoft\.com\.
Microsoft is hardly alone in shipping monster patch bundles lately\. Many other large software companies, including Adobe, Cisco, Google, Mozilla and Oracle, all have recently credited AI\-assisted research with increasing their patch cadence and volume \(Google said today it is now going to ship security updates every two weeks\)\.
**Tyler Reguly**, associate director of security research and development at**Fortra**, said one core challenge with deploying Windows updates is that they need to be tested before being installed across an organization because not all third\-party software works seamlessly in the face of changes to the underlying operating system\.
“It’s time to put our CISOs and CSOs on notice,” Reguly said\. “How are you helping your teams through these difficult times? Do you have your teams deploy after hours and on weekends to avoid disruption to the business environment? Do you reward them for that effort? Time to dig into your budget and buy dinner for your teams that are working on Saturday to get patches rolled out before users return to work on Monday\.”
**Satnam Narang**is senior staff research engineer at**Tenable**\. Narang said it’s important to recognize that while the number of vulnerabilities being patched by Microsoft is rising, the number of flaws that can and will affect most organizations remains quite low\.
“AI\-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn’t finding more needles,” he said\. “It’s critical that organizations understand which vulnerabilities actually apply to them, whether they pose a threat by being reachable and exploitable, and prioritize remediation based on this risk context\.”
Of course, regular Windows users don’t need to test patches before deploying them, but they still need to open Windows Update periodically or else assent to the program’s nag notices about pending updates\. And at the rate these Windows patch releases are ballooning in size, it’s probably best not to let them pile up month after month\.
Enterprise Windows admins will want to keep an eye on[askwoody\.com](https://www.askwoody.com/2026/september-2026-windows-updates-are-released/)for news of any updates that appear to be causing problems\. As always, the**SANS Internet Storm Center**has[a per\-patch breakdown](https://isc.sans.edu/diary/September%202026%20Microsoft%20Patch%20Tuesday/33320)ordered by severity and urgency\.
Similar Articles
Microsoft Plugs Nearly 400 Security Holes
Microsoft released patches for nearly 400 security vulnerabilities, including one actively exploited zero-day, as AI-driven discovery continues to swell patch volumes.
Microsoft Patches a Record 570 Security Flaws
Microsoft released a record 570 security patches for Windows and other software, including 60 critical flaws and three zero-days, attributing the increase to AI-assisted vulnerability discovery.
Microsoft patches record number of security vulnerabilities, citing its use of AI
Microsoft issued a record 570 security patches for Windows, Office, and other products, attributing the increase to AI-assisted vulnerability discovery.
Why this month's Microsoft patch release is a doozy
Microsoft patched a record 972 vulnerabilities in September 2026, with 112 critical, amid industry warnings about AI-enabled cyber attacks.
Microsoft breaks another patch Tuesday record
Microsoft is set to break another patch Tuesday record in September with over 650 security fixes for Windows, driven by AI models that rapidly discover software vulnerabilities.