Microsoft Fixes 974 Flaws in Record Patch Tuesday

Microsoft's September 2026 Patch Tuesday set a record by addressing 974 security flaws, including two zero-day vulnerabilities that have already been exploited. The vulnerabilities affect various components, with 723 impacting Windows and 111 targeting Office products. Security researchers suggest that Microsoft's use of AI-assisted tools may contribute to the high number of vulnerabilities discovered.

Two vulnerabilities, CVE-2026-81963 and CVE-2026-85880, are classified as actively exploited and can allow attackers to gain SYSTEM-level privileges. These should be prioritized by IT teams. Additionally, 20 vulnerabilities are potentially wormable, with CVE-2026-69730, a DNS server flaw, being particularly concerning. IT teams should focus on patching or mitigating these high-risk vulnerabilities first, followed by other exposed infrastructure components like DHCP, Remote Desktop Services, and Exchange Server.