> ## Content Index
> Fetch the complete content index at: https://globalfeed.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# Microsoft patched 972 flaws in one month, two already under attack
- URL: https://globalfeed.ai/en/microsoft-patched-972-flaws-in-one-month-two-already-under-attack/
- Published: 2026-09-09T22:22:58.000Z
- Updated: 2026-09-09T22:22:58.000Z
- Description: September's Patch Tuesday set a record: 972 new CVEs, 112 of them critical. Both actively exploited flaws are privilege escalation, the most sought-after link in a ransomware chain. The count runs from 964 to 974 depending on the source, which is a question of counting method.
- Author: GlobalFeed Editor
- Tags: Microsoft, Patch Tuesday, vulnerability, Windows, CVE, x-msftsecurity, dil-en, elle, video

**Microsoft** set a record on September's Patch Tuesday for the number of flaws fixed in a single month. By the Zero Day Initiative's count it is **972 new CVEs**, **112 of them critical**. Two were **already being exploited**.

## The two under active attack

- **CVE-2026-81963** · elevation of privilege in the Windows Update Stack.
- **CVE-2026-85880** · elevation of privilege in Windows ALPC.

Both are privilege escalation, so neither gets an attacker in on its own; each lets someone who already has a foothold **widen it**. That is the most sought-after link in a ransomware chain. These are the patches to put first.

## The number depends on who you ask

One detail is worth noting: the figure moves between sources. Microsoft's own release notes tally **974**, the Zero Day Initiative logs **972**, BleepingComputer counted **966** and Tenable put it at **964**. The gap comes from whether third-party components and cloud-side fixes are counted.

That does not shrink the story, but it shows something: **"how many flaws" is not one number**, it is a counting method. If a single figure is going into your month-end report, write down which list it came from.

## What to do this month

A record count makes patch order matter more, not less. The two exploited flaws come first. Then internet-facing servers and identity infrastructure. Closing all 972 items in one week was never possible; the work is sequencing. In an organisation with no test ring, a pile this size can turn patching itself into the cause of an outage.

## What this actually is

A patch list approaching four digits in one month shows two things together: the product surface keeps growing, and finding flaws keeps getting easier. As the codebase grew, auditing tooling automated; part of the rise in reported flaws comes from **more eyes looking**. The defensive clock does not move at the same speed, and the distance between a patch shipping and an organisation applying it is exactly where the attacker works.

Sources: [CrowdStrike analysis](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-september-2026/?ref=globalfeed.ai), [BleepingComputer](https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/?ref=globalfeed.ai).