Microsoft just dropped the largest Patch Tuesday in history. Not by a little. By a lot.
September 2026's security update patches 973 vulnerabilities across the Microsoft ecosystem, more than double August's count and shattering July's previous record of 570. If you thought the vulnerability pipeline was slowing down, think again. The AI-powered discovery engine that started reshaping Microsoft's release cadence earlier this year is accelerating, and the numbers are staggering.
The Numbers That Matter
Let's break down what landed on September 8:
- 973 total CVEs (966 per BleepingComputer, 974 per Microsoft's own count, 972 per ZDI -- the slight variance comes from how edge-case advisories are tallied)
- 113 rated Critical, including 82 remote code execution flaws and 27 elevation of privilege bugs
- 37 CVEs at CVSS 9.8 or higher -- the "nine-eight club" needed a bigger room this month
- 20 wormable vulnerabilities flagged by ZDI, meaning they could spread across networks without user interaction
- 58 marked "Exploitation More Likely" by Microsoft's own threat modeling
- 2 zero-day vulnerabilities already exploited in the wild
And that's not counting the 204 additional fixes Microsoft shipped earlier in the month for Azure AI Language, Azure Cosmos DB, Copilot Studio, Entra ID, and other cloud services. Those were pre-patched on a rolling basis but still count toward the broader September cycle.
Where the Bugs Live
The product breakdown tells you where the attack surface is expanding fastest:
- Windows: 723 CVEs
- Office: 111 CVEs
- SQL Server: 62 CVEs
- Developer Tools: 22 CVEs
- SharePoint Server: 16 CVEs
- Azure: 12 CVEs
- Skype for Business: 10 CVEs
- Exchange Server: 9 CVEs
Windows alone accounts for 74% of all patches. Office adds another 11%. Together, they represent the overwhelming majority of the attack surface that every enterprise security team needs to triage this week.
By vulnerability category: 438 elevation of privilege, 258 remote code execution, 173 information disclosure, 56 denial of service, 19 security feature bypass, 16 spoofing, and 13 tampering. The EoP dominance is striking -- nearly half the entire release is privilege escalation bugs, which tells you exactly what attackers are optimizing for.
The Two Zero-Days: ALPC and the Update Stack
Both exploited zero-days are elevation of privilege flaws that let an attacker escalate from standard user to SYSTEM. Both are already in CISA's Known Exploited Vulnerabilities catalog with a September 22 federal remediation deadline -- two weeks under the risk-tiered windows established by BOD 26-04 in June.
CVE-2026-85880 -- Windows ALPC Elevation of Privilege
This is a heap-based buffer overflow in Windows Advanced Local Procedure Call, credited to Volexity and Proofpoint's Mark Kelly, David Galazin, and Jeremy Hedges. These are threat intelligence shops that tend to find bugs inside real intrusions, not in lab environments. Microsoft hasn't disclosed how the flaw was being exploited, but the discovery credits alone should tell you this was found in active campaigns.
This is only the second ALPC zero-day since CVE-2023-21674 in January 2023 -- and the first ALPC fix in a Patch Tuesday in more than three years. ALPC is a fundamental inter-process communication mechanism in Windows. When it breaks, the consequences are architectural.
CVE-2026-81963 -- Windows Update Stack Elevation of Privilege
This one is a link-following vulnerability in the Windows Update Stack itself, credited to Romain Deperne and Microsoft's Threat Intelligence Centre (MSTIC). Yes, the update mechanism that's supposed to make your system more secure has a privilege escalation bug. Seven Windows Update Stack privilege bugs have been patched since 2022, but this is the first one exploited in the wild.
Both flaws share the same attack pattern: they require user interaction but can be triggered through documents, PDFs, and other attachments. In practice, expect them chained behind a code-execution vulnerability as the second stage of a malware drop. That's what local privilege-escalation zero-days are for -- turning a foothold into full control.
The AI Factor: Discovery Pipeline, Not Flattening Curve
Here's the part that should worry every CISO reading this. Microsoft deployed a proprietary multi-model agentic AI pipeline for vulnerability discovery earlier this year. In July, ZDI's Dustin Childs suggested it might be time to "readjust what we consider a true bug apocalypse." August dropped to 400. The narrative was that the curve was flattening.
September obliterated that narrative.
"Deep into the new normal," Childs wrote in his September analysis. "With nearly 1,000 CVEs coming out from Microsoft... there's a phrase from my military days that comes to mind: embrace the suck." He added that "AI-assisted vulnerability discovery shows no signs of slowing down."
The implication is clear: AI isn't just finding more bugs. It's finding more bugs faster, and the rate is accelerating. Every enterprise running Microsoft software is now patching against an adversary that has AI on its side and a defender that's struggling to keep pace with the output.
WMIC Is Gone, and the Broader Ecosystem Is Shaking
Two other notes from this release. First, WMIC (Windows Management Instrumentation Command-line) has been officially deprecated in this cycle. The tool that's been a staple of both sysadmins and attackers for decades is being phased out. If your automation scripts still depend on WMIC, start migrating now.
Second, the broader vendor ecosystem had a rough week too. Adobe Commerce (CVE-2026-75650) landed a CVSS 10.0 template-injection flaw that Sansec caught being exploited since September 4 and dubbed StyleSmuggler. Attackers used it to plant a Rust backdoor and PHP web shells. Adobe shipped an emergency bulletin on September 7, and CISA gave federal agencies a three-day deadline to patch.
Fortinet disclosed CVE-2026-26084, a high-severity FortiSandbox vulnerability allowing unauthenticated attackers to extract sensitive data via crafted HTTP requests. And Dell patched three critical vulnerabilities in its Secure Connect Gateway 5.0 platform that could grant root-level access.
What You Should Do Right Now
Priority 1: Patch the zero-days. CVE-2026-85880 (ALPC) and CVE-2026-81963 (Windows Update Stack) are both privilege escalation flaws being actively exploited. If you're running Windows in any capacity -- desktop, server, or containerized -- these go first.
Priority 2: Triage the Critical RCEs. With 82 remote code execution bugs at Critical severity, your Exchange, SharePoint, and SQL Server environments need immediate attention. The Office stack (111 CVEs) is the second-largest attack surface.
Priority 3: Audit your AI discovery pipeline. If your security team is using AI tools for vulnerability scanning, stress-test them against this volume. The gap between "AI found it" and "we patched it" is where breaches happen.
Priority 4: Kill your WMIC dependencies. This deprecation has been telegraphed, but if September is the final nail, your scripts need to migrate to PowerShell equivalents.
Priority 5: Check Adobe Commerce and Fortinet. Both have actively exploited or trivially exploitable flaws. If you're running either in production, patch today.
The Bottom Line
September 2026 isn't just another Patch Tuesday. It's a signal that the vulnerability landscape has permanently shifted. When AI-assisted discovery is generating nearly 1,000 patches per month from a single vendor, the old model of quarterly patch cycles and annual vulnerability reviews is dead.
The new reality is continuous patching, automated triage, and AI-vs-AI security operations. If your organization isn't there yet, this month's numbers should be your wake-up call.
The attackers aren't waiting. Neither should you.
Stay sharp. Patch fast. The vulnerability wave is only getting bigger.