Microsoft Patch Tuesday fixes record 974 Windows flaws

Microsoft's Patch Tuesday for September 2026 is the biggest single batch of security fixes the company has ever released. In updates issued on 8 September, Microsoft addressed at least 974 security holes across its Windows operating systems and other software, according to the report published at KrebsOnSecurity.com. That smashes the previous record, which was set only two months earlier, in July, when the company shipped fixes for at least 570 vulnerabilities. (Patch Tuesday is the day each month when Microsoft releases its regular bundle of security updates.)

The running total for the year is just as striking. With September's batch counted, Microsoft has now fixed more than 2,600 vulnerabilities in 2026, and there are still three months of the year to go. That is more than twice the company's previous record patch year, 2020, when it resolved 1,245 flaws.

Two of this month's fixes close flaws that attackers were already using before any update existed. Flaws in that situation are called zero-days. Both CVE-2026-81963 and CVE-2026-85880 let an attacker raise their level of control on a Windows system, a step known as privilege escalation, in which someone with limited access gains the rights of an administrator. A further 113 of the bugs patched this month carry Microsoft's "critical" rating, which means malware or a determined intruder could seize control of a vulnerable Windows machine with little or no help from the person sitting in front of it. (CVE numbers are public identifiers assigned to known security flaws so that everyone refers to the same one.)

One of the most serious entries in the batch is CVE-2026-69730, a weakness in the DNS role of Windows Server that is present from Windows Server 2012 onward and also affects Windows 10. DNS is the system that translates a website or server name into the numeric address computers use to reach each other, and a server that runs the DNS role answers those queries for other machines. Microsoft warns that an unauthenticated attacker, meaning someone with no valid login of any kind, could exploit the weakness simply by sending a specially crafted packet to an affected system. The company also states that the flaw is likely to be exploited.

Also rated critical is CVE-2026-69829, a remote code execution flaw in the Windows Shell. The Shell is the part of Windows that draws the desktop, files and Start menu. Remote code execution means an attacker can run their own code on the machine. This vulnerability carries a CVSS base score of 9.8 out of a maximum of 10, a scale that rates how severe and how easy to exploit a flaw is. Microsoft's assessment says it can be exploited with low attack complexity, with no privileges required and with no interaction from the user at all.

This kind of volume is not a Microsoft-only phenomenon. The report notes that Microsoft says artificial intelligence is helping to speed up the discovery of vulnerabilities, and that several other large software makers, among them Adobe, Cisco, Google, Mozilla and the vendor behind a widely used enterprise relational database, have recently credited AI-assisted research with increasing both the pace and the sheer number of patches they release. Google said on the day of Microsoft's release that it will now ship security updates every two weeks.

The harder problem is not finding the flaws but getting the fixes installed. Tyler Reguly, associate director of security research and development at Fortra, said one core challenge with deploying Windows updates is that they must be tested before being rolled out across an organisation, because not all third-party software keeps working when the operating system underneath it changes. He said it is time to put chief information security officers and chief security officers on notice, asking how they are helping their teams through this period, whether staff are being asked to deploy after hours and at weekends to avoid disruption, and whether that effort is recognised. His advice to leadership was direct: dig into the budget and buy dinner for the teams working on a Saturday so the patches are in place before users return on Monday.

Satnam Narang, senior staff research engineer at Tenable, cautions that raw patch counts can mislead. He said that while the number of vulnerabilities Microsoft patches is rising, the number of flaws that can and will affect most organisations remains quite low. In his words, AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it is not finding more needles. What matters, he argues, is that organisations understand which vulnerabilities actually apply to them, whether those flaws are reachable and exploitable in their own environment, and then prioritise what to fix on that basis.

Ordinary Windows users are in a different position from enterprise administrators. They do not need to test Microsoft's patches before installing them, but they do need to open Windows Update from time to time, or at least accept the prompts telling them updates are waiting. Given how quickly these monthly batches are growing, letting the fixes pile up month after month is not advisable. Administrators managing larger Windows estates can watch askwoody.com for news of updates that appear to cause problems after installation, and the SANS Internet Storm Center publishes its own per-patch breakdown ordered by severity and urgency.

For anyone running a website, the DNS flaw in this month's batch is a reminder that name resolution sits at the edge of almost every online service. AEU DNS (aeu-dns.com) is a private, secure DNS service that handles lookups on your behalf, and its page describes plainly what it does; it does not remove the need to install Microsoft's fixes on any Windows machines you operate yourself.