974 CVEs in One Month: Mapping the Windows Patch Surface With Internet-Wide Data

In September 2026, Microsoft released a patch that addressed 974 CVEs, including two zero-day exploits and a critical Exchange Remote Code Execution vulnerability. Vulnerability management teams typically view these releases as internal work queues; however, internet asset mapping provides an external perspective on the implications of the patch backlog.

Windows servers that miss the September patch fixes do not disclose their status, but the services they run often do. Services such as RDP, SMB, IIS, Exchange OWA, and remote access components expose version and configuration information that mapping platforms index. The key question for teams facing 974 fixes is not "how many CVEs affect us" but "which of our systems present an external face that maps onto the exploited or wormable subset."

September's release included 438 elevation-of-privilege issues, 257 remote code execution issues, and 20 wormable-class vulnerabilities. The elevation-of-privilege bugs are primarily significant after an initial foothold is established. The remote code execution and wormable subset directly relate to external exposure: an internet-reachable system running affected remote access components poses a different risk compared to an internal workstation with the same patch level.

Three mapping queries operationalize the patch management queue: enumerating external RDP and remote access surfaces per organization or ASN, indexing Exchange OWA and other webmail surfaces separately, and verifying post-patch disappearance of external banners and service versions. Mapping platforms like ZoomEye support these query patterns through product, service, and version fingerprints.

Despite its capabilities, mapping cannot detect patch levels behind firewalls or account for version lags in cloud and containerized deployments. Zero-day vulnerabilities require internal inventory as they are local privilege escalations. The division of labor between internal tools managing patch state and mapping platforms tracking the external face, along with a prioritized queue, is essential for effective vulnerability management.