Microsoft Just Patched 973 Vulnerabilities in One Day. The Reason Why Is the Real Story.

Microsoft’s September 2026 Patch Tuesday, released September 8, closed roughly 973 vulnerabilities in a single release. For scale: August was 421, July was 570 — and July was itself described at the time as the largest Patch Tuesday in Microsoft’s history. September more than doubled the previous month.

The interesting question isn’t how Microsoft shipped that many fixes. It’s why there were suddenly that many bugs to fix.

The likely explanation: Microsoft pointed AI at its own codebase

This release follows Microsoft deploying a proprietary multi-model agentic scanning system across the Windows codebase for vulnerability discovery.

That timing is hard to read as coincidence. A sudden doubling in disclosed vulnerabilities usually means one of two things: a dramatic decline in code quality, or a dramatic improvement in detection. Given the volume landed right after an AI-assisted scanning rollout, detection is the far more plausible answer.

Worth sitting with what that implies. These vulnerabilities existed before September. They existed in August, and in July. The only thing that changed is that something found them. If AI-assisted scanning is meaningfully better at finding bugs than the previous process was, then the historical patch counts weren’t measuring how many vulnerabilities existed — they were measuring how many anyone had spotted.

That cuts both ways, and it’s the genuinely uncomfortable part: the same capability is available to people who aren’t going to file a responsible disclosure.

The headline number is a moving target

A detail worth knowing if you cite this anywhere: nobody agrees on the count. Microsoft’s own release notes tally 974. Cisco Talos and Cybersecurity News landed on 973. The Zero Day Initiative logged 972 new CVEs. Tenable put it at 964. BleepingComputer counted 966.

The gaps come from counting methodology — Microsoft separately lists 25 republished CVEs assigned outside Microsoft, which should be treated separately from the headline figure, and different trackers make different calls about what counts as “new this month.”

None of that changes the practical picture. But if you’re quoting a specific number, quote the source with it.

The two zero-days, and why their rating is misleading

Both actively exploited flaws are local privilege escalation, both CVSS 7.8, and both rated Important rather than Critical:

CVE-2026-85880 — a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the mechanism Windows uses for inter-process communication. Microsoft’s advisory notes that an attacker able to execute code in a low-privilege AppContainer could exploit it locally to escape the sandbox and elevate privileges, with no additional user interaction required. Context from Tenable’s Satnam Narang: Microsoft hadn’t patched an ALPC flaw since April 2023, and this is only the second ALPC zero-day in nearly four years.

CVE-2026-81963 — an improper link resolution before file access (“link following”) defect in the Windows Update Stack, the components handling update installation. Also local privilege escalation to SYSTEM. Narang notes this is the first Update Stack weakness flagged as a zero-day among seven flaws resolved in that component over five years. Per MSRC, only Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025 are affected.

CISA added both to its Known Exploited Vulnerabilities catalog the same day.

Here’s the lesson worth extracting: neither is rated Critical, and both should be at the top of your patch queue. A severity rating describes theoretical impact. Confirmed in-the-wild exploitation describes what’s actually happening. If your prioritization process sorts by CVSS or by Microsoft’s severity label alone, it will deprioritize both of these behind hundreds of unexploited Critical-rated bugs.

Neither permits remote compromise on its own. Both are post-compromise escalation tools — which is exactly how modern intrusions chain together. An attacker who already has a foothold uses these to get SYSTEM.

Where the 973 actually live

Microsoft’s release data attributes 723 vulnerabilities to Windows, 62 to SQL, 22 to developer tools, 16 to SharePoint Server, and 9 to Exchange Server. Office figures vary between sources — some report 111, others 222 including 111 in Office 2016 specifically — which is part of the same counting-methodology inconsistency noted above.

By type, elevation of privilege dominates, followed by remote code execution and information disclosure. One release also reportedly includes 20 wormable flaws, and code execution on an Active Directory domain controller reachable by any authenticated domain user with a crafted request.

Two worth flagging specifically for developers, since they’re easy to miss in a Windows-dominated list:

• CVE-2026-84003 — spoofing in Microsoft Authentication Library (MSAL) for Node.js
• CVE-2026-83948 — remote code execution in Microsoft Azure CLI

If you have CI runners or developer machines with Azure CLI installed, that second one is in your environment whether or not you think of yourself as a “Microsoft shop.”

What to actually do with 973 vulnerabilities

You cannot patch 973 things by priority order in a week. The realistic approach is asset-based triage:

1. The two zero-days first, regardless of their Important rating, because exploitation is confirmed.
2. Windows Secure Kernel Mode and VBS vulnerabilities early in testing, given their proximity to the security boundaries meant to isolate sensitive operations.
3. Office RCEs next — the critical Word and Excel remote code execution bugs this month are the classic phishing-attachment path.
4. Identify which of the 973 apply to products you actually run, then concentrate on internet-facing systems, identity infrastructure, privileged endpoints, and widely deployed applications.
5. Confirm installation and restarts, and investigate failed or offline devices — at this volume, a partial rollout is easy to mistake for a complete one.

For the zero-days specifically, also review endpoint detection for privilege-escalation activity, unexpected child processes, altered update-related files, and local administrator abuse — patching closes the door but doesn’t tell you whether someone already walked through it.

The trend worth watching

If AI-assisted vulnerability discovery is what produced this number, September isn’t an anomaly — it’s the new baseline. Patch volume that doubles and stays doubled changes what a realistic patch cadence looks like for teams that were already struggling with the old volume.

Worth pairing with a figure from Mandiant: attackers now weaponize new vulnerabilities in roughly five days, while the median organization takes 43 days to patch. Doubling the input to a pipeline that’s already 38 days behind doesn’t improve that gap.

Official reference: Microsoft’s Security Update Guide and MSRC advisories for September 2026, with analysis from SecurityWeek, Tenable, Cisco Talos, and CISA’s Known Exploited Vulnerabilities catalog. Counts vary by source as described above — cite the specific tracker alongside any figure.