974 is a number that needs a second look before it means anything. Windows accounted for 723 of it, Office another 111, SQL Server 62, developer tools 22, SharePoint Server 16, Azure 12, Skype for Business 10 and Exchange Server 9, according to Infosecurity Magazine's breakdown of the release. Of that total, 119 were rated critical. It's the third record month in a row - 570 in July, which we covered as a record at the time, then 400 in August, then this. Put July and August together and you get 970. September beat that combined total on its own.
The math Microsoft basically told you was coming
We flagged Microsoft's July warning when we covered that month's record: the company told customers directly to expect more security updates because it was now using agentic AI tools internally to find zero-days faster than its human researchers could alone. Three months of consecutive records - each one bigger than the last - is either a company keeping a promise or a company that underestimated what it was promising, and from where we're sitting, it's genuinely hard to tell which. Either reading leads to the same place: this pace is not a one-off, and planning for a 400-CVE month as the new floor rather than the ceiling looks like the safer assumption.
Two zero-days, both local, both already live
SecurityWeek's coverage names the two flaws under active exploitation before Microsoft shipped a fix: CVE-2026-85880, a CVSS 7.8 heap-based buffer overflow in the Windows Advanced Local Procedure Call component that lets low-privilege AppContainer code escalate to System, and CVE-2026-81963, an improper link-resolution flaw in the Windows Update Stack that does much the same thing by a different route. Neither needs a network position or a user clicking anything - both need an attacker who's already got a foothold on the machine, which is precisely why they matter. A local privilege-escalation zero-day is the second stage of an attack, not the first, and finding two of them live in the same release means whoever's using them already has stage one solved somewhere.
Twenty bugs that don't need you to make a mistake
Beyond the two confirmed zero-days, the release includes 20 vulnerabilities Microsoft rates as wormable - exploitable for remote code execution with no authentication and no user interaction required at all. That's not a count of how many bugs are dangerous; every one of the 974 arguably is to someone. It's a count of how many don't depend on a phishing click, a weak password or a misconfigured share to matter. Among the critical highlights researchers pulled out: CVE-2026-55007, remote code execution in Exchange Server, CVE-2026-69465, remote code execution in SharePoint, and CVE-2026-69525, remote code execution in Remote Desktop Services - three of the most commonly internet-facing enterprise services on the list.
974 fixes is not 974 problems solved
Jack Bicer, Action1's director of vulnerability research, put the practical issue plainly in comments picked up by Infosecurity Magazine: at this scale, the challenge isn't working through the patch list, it's knowing what to work on first. A Tenable researcher made a related point - that AI-assisted discovery in 2026 is producing a bigger haystack, not necessarily more needles found per hour of analyst time. Both are ways of saying the same uncomfortable thing: a record CVE count is a measure of how much a vendor found, and says nothing on its own about how much of that any given organisation can actually triage, test and deploy before the two zero-days already in the wild get put to use somewhere they haven't patched yet.
- Prioritise CVE-2026-85880 and CVE-2026-81963 first - both are under active exploitation and both are local privilege-escalation, meaning any existing foothold on a Windows endpoint becomes System access.
- Give the 20 wormable-rated CVEs the next tier of urgency, particularly anything touching Exchange, SharePoint or Remote Desktop Services if those are internet-facing in your environment.
- Don't try to triage 974 CVEs by severity score alone - cross-reference against what's actually exposed and reachable in your own estate before deciding what waits.
- If your patch cadence assumes a few hundred CVEs a month as the ceiling, revisit that assumption; the last three months put the floor closer to 400 and climbing.
- Treat this release as a prompt to check your AppContainer and sandboxed-process boundaries specifically, since that's the layer both confirmed zero-days chip away at.
A record this size isn't a one-month spike to wait out - it's the third month running, and Microsoft told you in July it would keep happening. If your patch prioritisation process is starting to buckle under the volume, email sales@halfteck.com.