Microsoft Just Patched 974 CVEs in a Record September Update

Two Windows elevation-of-privilege flaws are already being exploited, making prioritization more important than the enormous headline number.

Microsoft's September 2026 security release is enormous even by modern Patch Tuesday standards. The company addressed 974 Microsoft CVEs across its product families, including two Windows elevation-of-privilege vulnerabilities that Microsoft says are already being exploited.

[Image: microsoft-974-cves-patch-tuesday.png — A large wave of security patches flowing toward Windows servers and endpoints]

The size of the release is the obvious headline. For administrators, the more useful story is how to avoid letting the headline number overwhelm the vulnerabilities that need attention first.

Two exploited Windows flaws sit at the top of the list

The September release includes two vulnerabilities marked as exploitation detected: CVE-2026–85880 and CVE-2026–81963.

CVE-2026–85880 affects Windows Advanced Local Procedure Call, or ALPC. Microsoft describes it as a heap-based buffer overflow that can allow an authorized local attacker to elevate privileges. Reporting on the release notes that an attacker able to execute code in a low-privilege AppContainer could use the flaw to escape the sandbox and gain SYSTEM-level privileges.

CVE-2026–81963 affects the Windows Update Stack. It involves improper link resolution before file access and can also allow a local attacker to elevate privileges.

Both carry CVSS 7.8 scores, according to NHS England's cyber alert, which recommends applying the relevant Microsoft updates and notes that exploitation has been reported.

Neither flaw is a one-click remote compromise by itself. An attacker needs an existing foothold or the ability to execute code locally. But privilege escalation vulnerabilities are valuable because they can turn limited access into control of the system.

The 974 CVEs span much more than Windows

The Hacker News reported that 723 of the vulnerabilities are associated with Windows. The release also includes 111 Office vulnerabilities, 62 in SQL, 22 in Developer Tools, plus issues across Azure, Exchange Server, SharePoint, Skype for Business, and other products.

More than 110 of the vulnerabilities are rated Critical in the reporting around the release.

Microsoft also republished 25 non-Microsoft CVEs in its update materials, bringing the total number of items handled in the broader release documentation even higher.

Those figures are useful for understanding scale, but they can be misleading if treated as a single queue of equally urgent work.

A Windows workstation exposed to an actively exploited privilege-escalation chain does not have the same risk profile as an internal server affected by a vulnerability that requires unusual configuration and has no known exploitation.

Patch management at this scale has to be risk management, not arithmetic.

A record release creates an operational problem of its own

Security teams have always had to prioritize, but a release approaching one thousand CVEs makes that discipline unavoidable.

The basic questions remain familiar:

1. Is exploitation already happening?
2. Is the affected product deployed in the environment?
3. Can an attacker reach the vulnerable component?
4. Does exploitation require authentication, local access, or special configuration?
5. What privilege or impact does successful exploitation provide?
6. Can the update be deployed safely without breaking critical workloads?

The exploited CVEs deserve immediate attention, especially on systems where a low-privilege foothold could be chained with other weaknesses. Internet-facing systems, administrator workstations, jump hosts, domain infrastructure, and heavily used endpoints may also deserve faster treatment depending on what the organization runs.

The remaining hundreds still matter, but they should move through a controlled testing and deployment process instead of competing equally for emergency status.

Bigger vulnerability counts do not automatically mean worse security

A release this large will inevitably be used as evidence that Microsoft software is becoming less secure. That conclusion is too simple.

CVE counts measure disclosed and tracked vulnerabilities, not the total number of undiscovered weaknesses in a product. Large vendors operate huge codebases, run extensive internal security programs, receive reports from external researchers, and increasingly use automated techniques to identify flaws at scale.

A rising count can therefore mean several things at once. The software may be complex. Researchers may be looking harder. Detection may be improving. Security teams may be filing more issues separately instead of combining them. AI-assisted code review and vulnerability discovery may also be increasing the volume of bugs found and fixed.

None of that makes 974 vulnerabilities unimportant.

It does mean the more useful measures are often time to remediation, exploitability, patch quality, exposure, and whether critical flaws are fixed before attackers can use them broadly.

The two actively exploited Windows vulnerabilities are more operationally meaningful this week than the record itself.

Patch Tuesday is becoming a prioritization exercise

Monthly patching once sounded like a predictable maintenance ritual. Modern enterprise estates make it much harder.

Organizations may be running multiple Windows versions, Office variants, SQL Server instances, development tooling, cloud-connected services, third-party security software, and applications with strict compatibility requirements. A large update can require testing across thousands of combinations.

At the same time, attackers do not wait for every regression test to finish.

That forces security and operations teams to split the problem. Known exploitation and high-impact exposures move first. Lower-risk updates follow through normal rings. Systems that cannot patch immediately need compensating controls, restricted access, monitoring, or temporary isolation.

The September release is an extreme example of why mature vulnerability management cannot simply mean "install everything as fast as possible."

It means understanding which fixes change the organization's risk today.

The 974-CVE record will get the attention, but the action item is narrower: identify whether CVE-2026–85880 and CVE-2026–81963 affect your Windows estate, prioritize exposed and valuable systems, then work through the rest of the release according to real risk. With patch volumes this large, knowing what to patch first is becoming as important as patching itself.