Microsoft has delivered a record-breaking September Patch Tuesday, with security researchers counting roughly 972 to 974 CVEs in Microsoft products and 112 critical-severity vulnerabilities, according to coverage from Ars Technica and The Register. Two flaws are already being exploited in the wild. The enterprise patch calendar, once a monthly nuisance, has evolved into a chandelier falling from the ceiling in slow motion.
🤚 The Open-Palm Patch Deluge
The headline number varies slightly depending on methodology — Microsoft patch counts are apparently less a statistic than an interpretive dance — but the scale is not in dispute. Zero Day Initiative researcher Dustin Childs counted 972 vulnerabilities, or 997 including Chromium fixes ported into Edge. The Register cited 974 CVEs in Microsoft products. Ars Technica noted that Microsoft fixed 570 vulnerabilities two months ago and around 620 last month, making this not an anomaly so much as a very expensive trend line.
Two actively exploited zero-days sit at the center of the silver-plated panic tray: CVE-2026-85880, a Windows Advanced Local Procedure Call privilege-escalation flaw, and CVE-2026-81963, a Windows Update Stack privilege-escalation vulnerability. Both can allow attackers to gain SYSTEM-level privileges. The U.S. Cybersecurity and Infrastructure Security Agency added the exploited Microsoft bugs to its Known Exploited Vulnerabilities catalog, giving federal agencies a deadline to patch them.
This is the cybersecurity equivalent of the maître d’ telling you the building is on fire but the tasting menu will continue in order of severity.
👐 The Two-Handed Enterprise Reality Check
The truly unpleasant detail is not just the two exploited bugs. It is the density of dangerous enterprise-facing issues around them. Childs highlighted CVE-2026-55007 in Exchange Server, where a remote unauthenticated attacker could potentially execute code by sending an email with a malicious Visio attachment. No user interaction, no charming phishing prelude, no tragic intern clicking “Enable Macros” like it is 2008. Just email as a velvet rope for code execution.
Other notable issues include CVE-2026-80097, a local privilege escalation in Microsoft Authenticator; CVE-2026-69465, covering multiple SharePoint remote-code-execution vulnerabilities; CVE-2026-65669, one of many SQL Server privilege-escalation bugs tied to SQL Copilot input; and CVE-2026-69525, a Remote Desktop Services remote-code-execution flaw with a 9.8 severity rating.
Ars reports that Childs saw so many wormable vulnerabilities in the release that he stopped counting at 20. In ordinary English, wormable means the vulnerability may spread without user interaction. In executive English, it means the board deck should contain fewer stock photos and more actual patch status.
🌿 The Gentle Awakening
The industry’s increasingly large patch releases are tied to a broader shift: AI-assisted vulnerability discovery is accelerating. The same machinery being marketed as a productivity assistant can also help researchers — and eventually attackers — find defects faster. In late August, major AI and cloud organizations warned of a narrowing window before AI-enabled attacks begin exploiting vulnerabilities at much greater speed.
This does not mean every AI-discovered bug is meaningful, nor that every model is a cyber oracle wearing a hoodie. Critics point to false positives, cost, and vendor incentives. But the practical result is visible: more bugs found, more patches shipped, and defenders forced to treat vulnerability management as a continuous function rather than a monthly ceremonial spreadsheet.
The old bargain was simple: software is flawed, vendors patch, admins test, attackers improvise. The new bargain is less comforting: machines help everyone improvise faster, and the winner is whoever converts chaos into disciplined operations before lunch.
👑 The Gold-Leaf Reckoning
The immediate advice is boring because reality often lacks branding: patch the exploited zero-days quickly, prioritize externally exposed Microsoft services, review Exchange, SharePoint, Remote Desktop, SQL Server, and authentication components, and watch for emergency advisories from Microsoft and CISA. If you run Adobe Commerce or Magento, The Register also notes an actively exploited Adobe Commerce/Magento flaw, CVE-2026-75650, addressed by Adobe, which deserves urgent attention for online shops.
The strategic lesson is less comfortable. Patch Tuesday has become a stress test of organizational maturity. Companies that still treat updates as a polite suggestion from IT will discover that attackers are not waiting for the change advisory board to locate its ceremonial stamp.
Microsoft did not create the entire vulnerability economy, but it remains one of its grandest ballrooms. This month, the orchestra is playing faster, the candles are melting, and the guests have been asked to apply 974 napkins to the leak before dessert.
“The cloud is secure, provided everyone patches the chandelier before it lands on payroll.” — The Slap of Wisdom Department of Managed Panic, approving an emergency maintenance window in evening wear