Microsoft patched 972 flaws in one month, two already under attack
September's Patch Tuesday set a record: 972 new CVEs, 112 of them critical. Both actively exploited flaws are privilege escalation, the most sought-after link in a ransomware chain. The count runs from 964 to 974 depending on the source, which is a question of counting method.
Microsoft set a record on September's Patch Tuesday for the number of flaws fixed in a single month. By the Zero Day Initiative's count it is 972 new CVEs, 112 of them critical. Two were already being exploited.
The two under active attack
- CVE-2026-81963 · elevation of privilege in the Windows Update Stack.
- CVE-2026-85880 · elevation of privilege in Windows ALPC.
Both are privilege escalation, so neither gets an attacker in on its own; each lets someone who already has a foothold widen it. That is the most sought-after link in a ransomware chain. These are the patches to put first.
The number depends on who you ask
One detail is worth noting: the figure moves between sources. Microsoft's own release notes tally 974, the Zero Day Initiative logs 972, BleepingComputer counted 966 and Tenable put it at 964. The gap comes from whether third-party components and cloud-side fixes are counted.
That does not shrink the story, but it shows something: "how many flaws" is not one number, it is a counting method. If a single figure is going into your month-end report, write down which list it came from.
What to do this month
A record count makes patch order matter more, not less. The two exploited flaws come first. Then internet-facing servers and identity infrastructure. Closing all 972 items in one week was never possible; the work is sequencing. In an organisation with no test ring, a pile this size can turn patching itself into the cause of an outage.
What this actually is
A patch list approaching four digits in one month shows two things together: the product surface keeps growing, and finding flaws keeps getting easier. As the codebase grew, auditing tooling automated; part of the rise in reported flaws comes from more eyes looking. The defensive clock does not move at the same speed, and the distance between a patch shipping and an organisation applying it is exactly where the attacker works.
Sources: CrowdStrike analysis, BleepingComputer.
