Microsoft's Record Patch Tuesday: ~1,000 Flaws, 113 Critical, 2 Zero-Days

Microsoft released a staggering nearly 1,000 security patches in its September Patch Tuesday bundle, obliterating the previous record of 570 vulnerabilities set in July and bringing 2026's total to more than 2,600 flaws—already more than double the company's previous record-setting year of 1,245 in 2020, with three months still to go. Of the bugs addressed, 113 earned Microsoft's "critical" rating, meaning they could be exploited by malware or attackers to seize control over vulnerable Windows machines with little or no user interaction. Microsoft says artificial intelligence is accelerating the discovery of vulnerabilities, but security experts warn the real bottleneck is now the human-intensive work of testing and deploying so many fixes each month.

Two zero-day flaws currently being actively exploited both allow attackers to elevate privileges on Windows systems: CVE-2026-81963 and CVE-2026-85880. Particularly alarming is CVE-2026-69730, a DNS weakness affecting Windows Server 2012 onward and Windows 10, which Microsoft warns an unauthenticated attacker could trigger by sending a single crafted packet—and which the company rates as likely to be exploited. Equally concerning is CVE-2026-69829, a remote code execution vulnerability in the Windows Shell with a CVSS base score of 9.8, exploitable with low attack complexity, no privileges, and no user interaction. Defenders auditing their own resolver paths can validate configurations with a DNS leak test.

Microsoft is hardly alone in shipping monster patch bundles. Adobe, Cisco, Google, Mozilla, and Oracle have all recently credited AI-assisted research with boosting their patch cadence and volume, and Google announced it will now ship security updates every two weeks. Tyler Reguly, associate director of security research and development at Fortra, said the core challenge is that Windows updates must be tested before deployment across an organization because not all third-party software works seamlessly after changes to the underlying operating system. "It's time to put our CISOs and CSOs on notice," Reguly said. "How are you helping your teams through these difficult times? Do you have your teams deploy after hours and on weekends to avoid disruption to the business environment? Do you reward them for that effort?"

For IT teams staring down this backlog, a quick port scanner sweep can identify exposed services that need immediate attention, while validating perimeter encryption on web-facing assets with an SSL/TLS checker rounds out a practical hardening pass before the next Patch Tuesday lands.