On Tuesday, Microsoft released the largest single batch of security fixes in the history of Patch Tuesday. 974 vulnerabilities, all at once. Add in a handful of non-Microsoft fixes that shipped alongside them and the real number crosses 999.
That’s a staggering headline. It’s also the wrong thing to focus on, and we’ll explain why.
But first, two of those flaws matter more than the other 972, because attackers are already using them.
The two you actually can’t ignore
Most vulnerabilities get patched before anyone in the real world figures out how to abuse them. That’s the whole point of patching early. Two of this month’s fixes are different, because Microsoft confirmed they’re being exploited in the wild right now.
Both are what’s called a privilege escalation flaw. In plain terms: an attacker who already has a small foothold on a Windows machine can use these to promote themselves to full SYSTEM control, the highest level of access there is. Think of it as someone who talked their way into the lobby suddenly holding the master key to every room in the building.
- CVE-2026-85880 lives in a piece of Windows that handles internal messaging between programs. An attacker running low-privilege code can use it to break out of its sandbox and take over the machine, with no clicking, no user interaction, nothing required from your staff.
- CVE-2026-81963 sits inside the Windows Update system itself. Every supported version of Windows gets this patch. It closes a hole that let an attacker trick Windows Update into replacing a legitimate system file with a malicious one.
The federal government moved fast on these. CISA added both to its official Known Exploited Vulnerabilities list and gave federal agencies a hard deadline of September 22 to get them patched. That deadline is a good yardstick for everyone else too. If the government treats two weeks as the outer limit, so should your business.
The rest of the pile
Beyond those two, a handful of the 974 stand out because they carry the highest severity scores and can be attacked over the network without a login. Several of these are in services businesses actually run: Remote Desktop, DNS, DHCP, and Exchange email servers. A few carry a 9.8 out of 10 severity rating, which is about as bad as the scale goes.
The good news is that these are exactly the kinds of systems a managed IT provider is already watching and patching on a schedule. They’re dangerous in the abstract, but they’re not the fire drill that the two exploited flaws are.
Why the record number is a distraction
Here’s the part worth slowing down on.
974 sounds terrifying. A year ago, a heavy Patch Tuesday was around 150 fixes. This month is nearly seven times that. So what happened?
The short version: the tools used to find vulnerabilities got dramatically better, and a lot of that is AI-assisted discovery. Microsoft has now patched over 2,760 flaws in 2026 alone, already more than double its previous worst year, with three months still left on the calendar. The vulnerabilities were always there. We’re just finding and fixing them faster than ever before.
That’s actually a good thing. Every one of these that gets patched is a door that closes before an attacker finds it. Security researchers have made this point clearly: a giant patch count means the attack surface is shrinking, not that the software is falling apart.
So the number itself isn’t the story. The story is that the volume has gotten so high that nobody can reasonably patch all of it at once, which means someone has to decide what gets fixed first, this week, versus what can wait for the normal cycle. That prioritization is the actual job now.
What we’re doing about it
We started reviewing this release the moment it dropped. Our team pulled the two actively exploited flaws to the front of the line and is working through our managed clients’ systems to confirm they’re covered well ahead of the September 22 benchmark. From there we’re working down the list of critical, network-facing fixes on the servers and services our clients depend on.
This is the unglamorous work that a managed IT relationship is built on. Nobody sees it, and that’s the point. When Microsoft drops a thousand fixes on a Tuesday, the difference between a client who has to worry about it and one who doesn’t comes down to whether someone is already sorting the urgent from the routine on their behalf.
The takeaway
You don’t need to memorize CVE numbers or understand what a heap-based buffer overflow is. Here’s the whole thing in three lines:
- Two Windows flaws are being actively exploited, and they need patching within the next couple of weeks, not next month.
- The record-breaking 974 number is real, but it’s mostly a sign that the industry is getting better at finding problems, not a reason to panic.
- The real work is prioritization, making sure the handful that matter get handled first.
If you’re not certain whether your systems are getting patched on a real schedule, or whether anyone is triaging the urgent fixes when a month like this hits, that’s a quick thing to check on a call.
Schedule a Cybersecurity Assessment
When was the last time anyone confirmed your systems are actually getting patched on a real schedule, and that someone is triaging the urgent fixes when a month like this one hits?
Cybertek Systems manages patching and vulnerability response for businesses, schools, clinics, and municipalities across South Dakota and Nebraska, sorting the urgent from the routine so a record-breaking Patch Tuesday doesn’t become your problem to solve.
Schedule a free Cybersecurity Assessment and we’ll review how your systems get patched today and where it’s leaving you exposed.
Call us at (605) 842-TECH (8324) Or join us at Tech Tuesday, held the 2nd and 4th Tuesday of every month.
Cole Nicholas is the owner of Cybertek Systems, a managed IT, cybersecurity, surveillance, and VoIP provider based in Winner, South Dakota, serving rural and regional businesses across the Northern Plains.
Sources:
- Microsoft Security Update Guide, September 2026 (msrc.microsoft.com)
- CISA Adds Four Known Exploited Vulnerabilities to Catalog (cisa.gov)
- “Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days” (The Hacker News)