Microsoft Patches Nearly a Thousand Vulnerabilities in a Single Month — a New Record

Microsoft has released its monthly batch of security updates, fixing at least 974 vulnerabilities in Windows and other products. It's the largest single set of fixes in the company's entire history — surpassing the previous record set in July, when 570 flaws were closed.

With September's “Patch Tuesday” factored in, the running total for the year has climbed past 2,600 fixes. That's more than double Microsoft's previous annual record, set in 2020 (1,245) — and there are still three months left in the year.

The most dangerous of the bunch

Two of the vulnerabilities are already being actively exploited by attackers: CVE-2026-81963 and CVE-2026-85880 both allow privilege escalation on Windows systems. A total of 113 bugs were rated critical — they can be used to fully take over a vulnerable machine with virtually no user interaction.

Two flaws are especially alarming. CVE-2026-69730 is a weakness in the DNS service, present in Windows Server from the 2012 version onward and in Windows 10; an unauthenticated attacker can exploit it simply by sending a specially crafted packet, and Microsoft considers exploitation likely. CVE-2026-69829 is a remote code execution vulnerability in the Windows shell with a CVSS score of 9.8 out of 10, triggered without privileges and without any user action.

AI grows the haystacks, not the needles

Microsoft attributes the surge in discoveries to the use of artificial intelligence in hunting for vulnerabilities. The company isn't alone: Adobe, Cisco, Google, Mozilla and Oracle also tie the increased frequency and volume of patches to AI-driven research. On the same day, Google announced it was moving to biweekly security updates.

Experts, however, warn about the human side of the equation. Tyler Reguly of Fortra points out that Windows updates have to be tested before deployment: not all third-party software runs smoothly after changes to the operating system. He urges security leaders to think about how they're supporting their teams, who often have to roll out patches on weekends and after hours — and at the very least to buy them dinner for their Saturday labors.

Satnam Narang of Tenable offers a sobering thought: more fixes doesn't mean more real danger. “AI vulnerability hunting in 2026 is producing bigger haystacks, but not finding more needles,” he says. What matters is understanding which vulnerabilities actually apply to a given infrastructure, which are reachable and exploitable, and setting priorities based on that context.

Ordinary users don't need to test patches — it's enough not to put off installing updates. But given how fast the monthly bundles are ballooning, hoarding them for months on end is definitely a bad idea.

Source: Krebs on Security