Microsoft's September 2026 Patch Tuesday fixed 974 vulnerabilities, plus 25 non-Microsoft CVEs routed through the same release — 999 in total.

By product: 723 in Windows, 111 in Office, 62 in SQL, 22 in developer tools. More than 110 rated critical. Roughly 90% fall into three classes: privilege escalation, remote code execution and information disclosure.

Start with the two

2 of the 974 are being exploited right now, and both are the same shape. CVE-2026-85880, CVSS 7.8, is a heap-based buffer overflow in the Windows Advanced Local Procedure Call subsystem. CVE-2026-81963, also 7.8, is an improper link resolution flaw in the Windows Update Stack. Neither is remote: both need an attacker already executing code on the machine, and both end at SYSTEM.

That is not a reason to relax. It is a description of where they sit in a chain, and it tells you exactly what to prioritise.

If an attacker has a foothold, these are what turn it into ownership of the host. The browser toolkit we covered this week needed precisely this — prior administrative or code execution access, which it does not supply itself. Local privilege escalation is the missing half of a great many post-compromise toolkits, and September shipped two working ones.

Patch those two first. The other 972 can follow your normal cycle.

Why the total is the wrong unit

Treating 974 as 974 emergencies means doing all of them badly, and the distribution says why. 723 are in Windows, 111 in Office, 62 in SQL, 22 in developer tools — and roughly 90% fall into three classes: privilege escalation, remote code execution and information disclosure. More than 110 carry a critical rating, which is far more than any team can put first.

So the number to work from is not 974. It is the count of things reachable from somewhere an attacker can already stand, which for most estates is a small fraction of the total and does not correlate well with CVSS. Rank by exposure. A critical flaw in a component you do not run is not a critical flaw for you, and a 7.8 that is being exploited is.

The number is a counting event, not a security event

974 against a previous record of 569 is a 70% jump in one month. Set beside the rest of the year — 457 in August, 663 or thereabouts in July depending on whose count you take, 220 in June, 161 in May — it is not a trend, it is a discontinuity. Software does not get four times worse in four months, so something about how these are found, counted or disclosed changed, and Microsoft has not said what.

The candidates, none of them established:

  • Automated discovery at scale. Fuzzing and AI-assisted analysis produce findings faster than triage historically did, and a backlog eventually ships.
  • A change in what gets a CVE. Components that previously shipped fixes silently — cloud-side, edge, service code — being issued CVEs would move the number without changing anything about risk.
  • A batch release of accumulated internal findings.

The distinction matters for one practical reason: if the number rose because counting changed, then next month's number is the new normal and nobody should draw a conclusion from it. If it rose because discovery genuinely accelerated, the backlog on every other vendor is about to become visible too.

Worth noting a wrinkle in the reporting itself: the figures circulating give July as both 663 and 569, the latter as the previous record. Those cannot both be the same measurement, and nobody has reconciled them. Treat the exact comparison loosely and the direction as clear.

What to do

  • Patch CVE-2026-85880 and CVE-2026-81963 on an emergency cycle. Exploited, local, SYSTEM.
  • Then treat the rest as a normal month. 974 is not 974 emergencies, and an organisation that tries to treat it as one will do nothing well.
  • Rank the remaining critical items by exposure, not by CVSS. More than 110 critical ratings cannot all be first.
  • Expect your scanner to be noisy for a fortnight. A near-thousand-CVE release moves every dashboard, and the movement is not information.
  • Do not read the total as a signal about Windows. Nobody has established why it jumped.

What is not established

  • Why the number rose so sharply. Microsoft has not explained it.
  • Who is exploiting the two zero-days, or against whom.
  • Whether the previous record was 569 or 663. The reporting gives both.
  • Whether any of the 974 are publicly disclosed but not yet exploited. Not broken out.