Microsoft Issues Record Patch Tuesday Bundle Addressing 974 Vulnerabilities

Microsoft Issues Record Patch Tuesday Bundle Addressing 974 Vulnerabilities Microsoft released updates fixing at least 974 security holes in Windows and other software, marking its largest single patch release to date and highlighting how AI-assisted vulnerability discovery is intensifying testing and deployment workloads for organizations. The September update addresses at least 974 vulnerabilities, pushing the 2026 total past 2,600 and more than doubling the prior full-year record set in 2020. The release fixes two actively exploited zero-day privilege elevation vulnerabilities alongside 113 critical bugs, including major DNS and Windows Shell flaws. Multiple technology companies credit AI with driving surging patch counts, creating substantial testing friction and weekend deployment burdens for enterprise IT teams. Unprecedented Patch Volume Driven by AI Microsoft's 974-patch release breaks its previous monthly high of 570 fixes set in July and brings the annual count to more than 2,600 with three months left in the year. Microsoft attributed the accelerated pace to artificial intelligence, a trend echoed across the technology industry. Vendors including Adobe, Cisco, Google, Mozilla, and Oracle have similarly cited AI-assisted research for increased patch frequency and volume, with Google announcing a shift to releasing security updates every two weeks. Actively Exploited Zero-Days and Critical Flaws The release addresses two actively exploited zero-day privilege elevation bugs, designated as CVE-2026-81963 and CVE-2026-85880. In total, 113 vulnerabilities were classified as critical. Among the most severe is CVE-2026-69730, a DNS vulnerability affecting Windows 10 and Windows Server 2012 onward that enables an unauthenticated attacker to exploit systems via crafted packets. Another severe bug, CVE-2026-69829, is a Windows Shell remote code execution vulnerability rated 9.8 on the CVSS scale that requires low attack complexity, no privileges, and no user interaction. Operational Strain and Risk-Based Prioritization Security analysts emphasized that the surge in patches complicates the labor-intensive work of testing and deployment. Tyler Reguly of Fortra pointed out that operating system patches must be validated against third-party software, placing significant off-hours strain on security teams. Satnam Narang of Tenable observed that AI discovery creates larger volumes of reported bugs without necessarily finding more actionable threats, urging organizations to prioritize remediation based on reachability and actual organizational risk.

微软发布近千个安全补丁创历史新高，AI助推漏洞发现引发企业部署挑战 微软在本次补丁星期二发布了针对至少974个安全漏洞的更新，创下有史以来单次补丁数量的最高纪录，推动今年累计修复数量突破2600个。虽然AI加速了漏洞发现，但庞大的补丁量也给企业安全团队的测试与部署带来了巨大压力。 微软本次发布至少974个漏洞补丁，包含2个已遭在野利用的零日漏洞和113个严重级别缺陷。 今年补丁总数已超2600个，远超2020年创下的全年度1245个的纪录。 包含CVE-2026-69730（DNS缺陷）和CVSS 9.8分的CVE-2026-69829（Windows Shell远程代码执行）等关键高危漏洞被修复。 专家指出，AI扩大了漏洞总量但企业实际受威胁的核心漏洞仍有限，机构需强化风险优先级评估与补丁测试。 补丁数量打破历史纪录并包含在野利用漏洞 本月更新打破了微软此前在7月创下的570个漏洞的单月纪录，使得2026年累计补丁数已超2600个。在修复的974个漏洞中，包含113个严重漏洞，以及两个已被用于提升Windows系统权限的在野零日漏洞CVE-2026-81963和CVE-2026-85880。此外，Windows Shell中的远程代码执行漏洞CVE-2026-69829评分高达9.8，攻击者无需特权和用户交互即可利用；影响Windows 10及Windows Server 2012起版本的DNS漏洞CVE-2026-69730同样面临高利用风险。 AI加速漏洞发掘引发全行业补丁浪潮 微软将漏洞激增归功于AI辅助研究，而Adobe、Cisco、Google、Mozilla和Oracle等大型软件厂商也均将补丁频次与数量的上升归功于AI。例如Google已宣布将每两周发布一次安全更新。AI驱动的自动化发现正从根本上提高整个行业披露和修补安全漏洞的节奏。 企业部署负担加重与优先级筛选诉求 Fortra专家Tyler Reguly指出，由于系统底层更改可能影响第三方软件运行，企业在部署前必须进行测试，这导致IT团队不得不加班甚至在周末进行部署。Tenable研究员Satnam Narang则表示，AI制造了更大的“草堆”但并未带来更多致命的“针”，对大多数机构造成威胁的漏洞比例依然很低，安全团队应基于漏洞是否可触达和可利用等风险上下文来合理安排修复优先级。

**Microsoft Corp.** today issued updates to plug at least 974 security holes in its **Windows** operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and deploying so many fixes each month. This month’s patch bundle obliterates the software giant’s [previous record set in July](https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/), when it released updates for at least 570 security vulnerabilities. September’s Patch Tuesday brings this year’s total to more than 2,600, more than twice Microsoft’s previous record-setting patch year in 2020 (1,245) and with three more months to go. There are two “zero-day” flaws fixed this month that are being actively exploited: both [CVE-2026-81963](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-81963) and [CVE-2026-85880](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-85880) allow an attacker to elevate their privileges on Windows system. Fully 113 of the bugs addressed today earned Microsoft’s “critical” rating, meaning they could be abused by malware or miscreants to seize control over a vulnerable Windows machine with little or no help from the user. Among the more serious critical flaws this month is [CVE-2026-69730](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-69730), a DNS weakness present in Windows Server 2012 onward and on Windows 10. Microsoft warns that an unauthenticated attacker could leverage this weakness simply by sending a specially crafted packet to an affected system, and that it is likely to be exploited. Also scary is [CVE-2026-69829](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-69829), a critical, remote code execution flaw in the Windows Shell. This vulnerability has a CVSS base score of 9.8 (10 is the most severe), and can be exploited with low attack complexity, no privileges, and no user interaction. Microsoft is hardly alone in shipping monster patch bundles lately. Many other large software companies, including Adobe, Cisco, Google, Mozilla and Oracle, all have recently credited AI-assisted research with increasing their patch cadence and volume (Google said today it is now going to ship security updates every two weeks). **Tyler Reguly**, associate director of security research and development at **Fortra**, said one core challenge with deploying Windows updates is that they need to be tested before being installed across an organization because not all third-party software works seamlessly in the face of changes to the underlying operating system. “It’s time to put our CISOs and CSOs on notice,” Reguly said. “How are you helping your teams through these difficult times? Do you have your teams deploy after hours and on weekends to avoid disruption to the business environment? Do you reward them for that effort? Time to dig into your budget and buy dinner for your teams that are working on Saturday to get patches rolled out before users return to work on Monday.” **Satnam Narang** is senior staff research engineer at **Tenable**. Narang said it’s important to recognize that while the number of vulnerabilities being patched by Microsoft is rising, the number of flaws that can and will affect most organizations remains quite low. “AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn’t finding more needles,” he said. “It’s critical that organizations understand which vulnerabilities actually apply to them, whether they pose a threat by being reachable and exploitable, and prioritize remediation based on this risk context.” Of course, regular Windows users don’t need to test patches before deploying them, but they still need to open Windows Update periodically or else assent to the program’s nag notices about pending updates. And at the rate these Windows patch releases are ballooning in size, it’s probably best not to let them pile up month after month. Enterprise Windows admins will want to keep an eye on [askwoody.com](https://www.askwoody.com/2026/september-2026-windows-updates-are-released/) for news of any updates that appear to be causing problems. As always, the **SANS Internet Storm Center** has [a per-patch breakdown](https://isc.sans.edu/diary/September%202026%20Microsoft%20Patch%20Tuesday/33320) ordered by severity and urgency.