Microsoft’s September 2026 Patch Tuesday has set a jaw-dropping record — and not in a good way for enterprise security teams. Released on September 9, the monthly update addresses a staggering 966 Common Vulnerabilities and Exposures (CVEs), making it the largest security update in the company’s history. When combined with 204 additional vulnerabilities Microsoft patched earlier in the month across Azure, Copilot Studio, Entra ID, Microsoft Edge, Fabric, and Power Automate, the true September total exceeds 1,170 fixes — a number that would have seemed inconceivable just a year ago.
Two of those vulnerabilities are being actively exploited in the wild, CISA has placed one on its Known Exploited Vulnerabilities catalog, and twenty more meet the technical definition of “wormable.” For IT and security teams, this is not a patch cycle to defer.
By the Numbers: A Month That Broke Every Record
Previous monthly records already felt enormous. Microsoft’s July 2026 Patch Tuesday — itself a record at the time — addressed 570 CVEs. September blew past that figure by nearly 70 percent. The September release includes 105 vulnerabilities rated Critical, 81 of which enable remote code execution, 20 involve elevation of privilege, 2 are information disclosure, and 1 is a security feature bypass. The remaining hundreds range from Important to Moderate and Low in severity.
Security researchers and vulnerability-tracking firms have offered varying final counts — BleepingComputer reports 966, Tenable 964, Cybersecurity News 973, SecurityWeek 974 — reflecting minor differences in counting methodology. What no one disputes is that this is unprecedented territory.
Microsoft’s own explanation for the surge: artificial intelligence. The company confirmed that its internal AI-powered vulnerability scanning has dramatically accelerated the rate at which engineers discover and catalog their own bugs. The same AI tooling that is being marketed to enterprises as a productivity multiplier is, it turns out, also a remarkably efficient way to find problems hiding in a codebase the size of Windows. The discovery rate has outpaced the disclosure rate, leading to the massive backlog visible in this release.
Two Zero-Days Under Active Exploitation
The two vulnerabilities confirmed as exploited in the wild before this Patch Tuesday demand immediate attention.
CVE-2026-81963 — Windows Update Stack Elevation of Privilege. This flaw sits within the very component responsible for installing Windows updates — a deeply uncomfortable position for a security vulnerability. Classified as an “improper link resolution before file access” weakness, it allows a local attacker to gain SYSTEM-level privileges by manipulating file paths that the update stack follows without sufficient validation. It is the first Windows Update Stack vulnerability to carry zero-day status in five years of tracking. CISA added CVE-2026-81963 to its Known Exploited Vulnerabilities Catalog on September 10, with a mandatory patch deadline for federal agencies of September 22.
CVE-2026-85880 — Windows ALPC Elevation of Privilege. This vulnerability lives in Windows Advanced Local Procedure Call, the inter-process communication mechanism that underpins hundreds of Windows subsystems. It is a heap buffer overflow rated CVSSv3 7.8, and a successful exploit lets a low-privileged attacker operating inside an AppContainer sandbox escape that containment and obtain SYSTEM-level control. Microsoft reports exploitation in the wild but has not attributed it to a specific threat actor.
Both zero-days are local privilege escalation bugs rather than remote code execution, meaning an attacker needs an initial foothold — but obtaining that foothold through phishing or a web exploit, then escalating with either CVE, is a well-documented attack pattern.
Twenty Wormable Vulnerabilities: The Bigger Systemic Risk
Zero-days attract the most immediate press attention, but security researchers from the Zero Day Initiative (ZDI) and others have flagged the twenty wormable vulnerabilities in this release as the deeper systemic concern.
A wormable vulnerability allows an attacker to exploit a system without any user interaction and then automatically propagate to adjacent systems — the same class of flaw that made WannaCry and NotPetya so devastating. This month’s list of wormable flaws spans an alarming range of Windows network services: DNS Server, DHCP Server, Routing and Remote Access, Message Queuing, Failover Cluster, Netlogon, Active Directory Domain Services, Secure Socket Tunneling Protocol (SSTP), Network File System (NFS), SMB Client, IP Helper, Internet Connection Sharing, and Reliable Multicast Transport.
The most critical of these is CVE-2026-69730, a Windows DNS Server remote code execution vulnerability carrying a CVSS score of 9.8. An unauthenticated attacker on the network who can reach a DNS server can execute arbitrary code on it. Given that DNS servers are often among the most exposed and trusted systems in a corporate network, this is an extremely high-priority patch.
CVE-2026-55007, affecting Microsoft Exchange Server, is also receiving significant attention. Rated CVSS 8.1, it allows a remote unauthenticated attacker to achieve code execution on an Exchange server simply by sending an email containing a malicious Visio attachment. No user needs to open the email in a mail client — the server-side processing of the attachment is sufficient to trigger exploitation. Any organization still operating on-premises Exchange infrastructure should treat this fix as an emergency.
Adobe Joins the Patch Day: 170 Vulnerabilities Including a Commerce Zero-Day
Patch Tuesday is traditionally a Microsoft-centric event, but Adobe routinely releases its own security updates in parallel. September 2026 was no exception. Adobe released nine advisories addressing 170 vulnerabilities across Experience Manager, ColdFusion, Photoshop, Illustrator, Animate, Commerce, Acrobat Reader, and Campaign Classic.
Most notably, Adobe patched an actively exploited zero-day in Adobe Commerce and Magento designated CVE-2026-75650 and nicknamed “StyleSmuggler,” allowing attackers to deploy Linux backdoors and web shells on vulnerable Commerce installations. Security teams running Adobe Commerce storefronts should apply this patch immediately as exploitation is already underway.
What IT and Security Teams Should Do Now
With a patch list of this magnitude, prioritization is essential. First, deploy patches for CVE-2026-81963 and CVE-2026-85880 — the two zero-days confirmed exploited in the wild — across all Windows endpoints. CISA’s September 22 deadline applies to federal systems, but the threat is not limited to government networks.
Second, isolate and patch any internet-facing or network-exposed DNS servers to address CVE-2026-69730. A CVSS 9.8 unauthenticated RCE on a critical infrastructure component is not something that survives a measured patch schedule. Third, address Exchange Server if running on-premises. CVE-2026-55007 requires no user interaction and no authentication, making it an appealing and accessible target.
Fourth, work through the remaining twenty wormable vulnerabilities, prioritizing systems that host or expose the affected services (DHCP, SSTP, NFS, SMB) to the network. Finally, apply the full patch set — all 966 CVEs — as rapidly as testing cycles allow. Microsoft’s AI-assisted discovery program is unlikely to slow down, and waiting for a quieter month may no longer be a viable strategy.
The New Normal
Microsoft’s acknowledgment that AI-powered internal scanning is driving the record-breaking CVE counts is significant beyond any individual patch release. It signals that the security industry’s relationship with vulnerability counts is shifting. More bugs are being found — not necessarily because software quality has declined, but because the tools for finding bugs have improved dramatically.
For enterprise defenders, that is ultimately a good thing: known vulnerabilities that are patched are safer than unknown ones silently sitting in production. But it places an intensifying burden on security and IT operations teams who must absorb these updates at a rate that human processes were not designed to handle.
September 2026’s Patch Tuesday may be remembered not just as a record but as the moment it became undeniable that traditional monthly patching cadences are no longer sufficient for the AI-accelerated vulnerability era.
