Microsoft’s September update release patched close to a thousand vulnerabilities in a single day, the largest Patch Tuesday the company has ever shipped. Two of those flaws were already being exploited before the patch existed. A third, a DNS server bug Microsoft’s own advisory does not shy away from comparing to one of the most dangerous Windows vulnerabilities of the last decade, can spread on its own between unpatched servers. For security teams, the headline number is less important than the question the release forces: when a single vendor hands you nearly a thousand fixes at once, how do you decide which ones actually protect you first.
A record haul, and two flaws already in use
Trade-press tallies of Tuesday’s release put the count at 974 CVEs; the Zero Day Initiative, the Trend Micro-owned program that tracks and coordinates a large share of externally reported Microsoft bugs, counted 997 once 25 Chromium-derived bugs affecting Microsoft Edge are folded in. Either figure is the largest monthly release Microsoft has shipped.
Two of the flaws were confirmed under active exploitation ahead of the patch: CVE-2026-81963, an elevation-of-privilege bug in the Windows Update Stack affecting Windows 11 and Windows Server 2025, and CVE-2026-85880, an elevation-of-privilege flaw in Windows’s Advanced Local Procedure Call component affecting Windows 10 and Windows Server 2012 through 2022. Both let an attacker who already has low-privilege code execution on a machine escalate to SYSTEM, the kind of bug that turns a phishing foothold or a browser exploit into full control of the box.
Media Partner
The bug drawing the most attention isn’t one of the zero-days
The flaw security researchers are watching most closely this month was not exploited yet at release. CVE-2026-69730 is a remote code execution vulnerability in Windows DNS Server, and Microsoft’s own advisory describes it as SigRed’s spiritual successor, a reference to the 2020 Windows DNS Server bug that could spread between servers with no user interaction and briefly worried the industry with worm potential. CVE-2026-69730 sits inside a cluster of 20 wormable bugs in this release that a remote, unauthenticated attacker could use to get arbitrary code execution with no user interaction, according to the Zero Day Initiative’s review of the release.
DNS servers are exposed by design, which is what made the original SigRed dangerous enough that Microsoft issued out-of-band guidance for it in 2020 and the flaw stayed on active exploitation watchlists for months after. A wormable DNS bug that has not yet been weaponized is, in a real sense, more urgent than a privilege-escalation flaw that has: the window to patch before the first working exploit appears is the entire value of the warning.
What it means for the security leader
A thousand-CVE release is not a thousand equally urgent problems. Dustin Childs, communications manager at the Zero Day Initiative, summed up the scale of this release plainly: “there’s a phrase from my military days that comes to mind: embrace the suck.” That is a fair description of the triage problem this creates for any team that patches on a fixed monthly cycle. Treating a release like this as a single queue, worked top to bottom by severity score alone, is how the two already-exploited bugs and the wormable DNS flaw end up patched in the same batch as several hundred low-risk fixes that could safely wait a cycle.
The more useful triage order for this specific release is: patch DNS Server first, wherever it is internet-facing or reachable from a segment an attacker could already be in, because SigRed’s history is the clearest evidence available that a wormable DNS bug does not stay theoretical for long. Patch the two actively exploited elevation-of-privilege bugs on any endpoint where a foothold is even plausible, which in practice means most of the fleet. Then work through the rest of the release by exposure and asset criticality rather than by CVSS score in isolation, since a base score does not capture whether a given system is internet-reachable, already has compensating controls, or sits next to something that does. This is the same triage failure mode CyberTech has covered before: CVSS tells you how bad a flaw could be in the abstract, not what to patch first in your specific environment, and a record-size release is exactly when that gap becomes expensive.
The pattern is bigger than one vendor
Microsoft’s release cadence has been trending upward for several cycles now, and this is not the first month CyberTech has had to report a record-breaking patch volume paired with a genuinely urgent subset. The same underlying problem shows up whenever vendor scoring and real-world exploitation timelines diverge: a CVSS 9.8 sitting unexploited for months next to a CVSS 7.8 already being used in the wild. Security teams that still run patch cycles built around volume, apply everything with a set severity threshold every 30 days, are structurally behind the two-day window between disclosure and the first observed exploit that flaws like the Update Stack and ALPC bugs in this release represent.
What to do
Prioritize CVE-2026-69730 on every internet-facing or lateral-movement-reachable DNS Server instance immediately, treating it with the same urgency organizations gave SigRed in 2020. Confirm the two actively exploited elevation-of-privilege bugs, CVE-2026-81963 and CVE-2026-85880, are patched on any system where initial access is plausible, which for most organizations means the full endpoint fleet, not just servers. For the remaining several hundred fixes in this release, sequence by exposure and exploitability signal rather than CVSS score alone, and expect Microsoft’s monthly volume to keep climbing rather than reverting to the smaller releases of a few years ago.
