Microsoft Patch Tuesday Sets Record: 974 Flaws Fixed, 2 Exploited

On September 8th, Microsoft shipped the largest single batch of security fixes in its history: 974 patches in one release, nearly double what a typical month looks like. Two of the bugs it fixed were already being used by attackers before anyone outside Microsoft knew they existed, and one of the flaws left unpatched is bad enough that a stranger on the internet could take over a server without ever needing a password.

A Patch Count That Broke Its Own Record

Patch Tuesday is Microsoft's monthly ritual — the second Tuesday of every month, when it bundles up fixes for every flaw its engineers and outside researchers have found across Windows, Office, Azure and the rest of its product line. Most months bring somewhere between 100 and 150 fixes. This one blew past that by a wide margin, with 113 of the 974 rated "critical" — the top severity tier.

Windows itself accounted for the bulk of it, with 723 fixes, followed by Office at 222, SQL Server at 62, developer tools at 22, SharePoint at 16, Azure at 12, Skype for Business at 10 and Exchange Server at 9. Elevation-of-privilege bugs — flaws that let someone who already has a small foothold on a machine grab full administrator-level control — made up nearly half the list, with remote code execution flaws (bugs that let an outsider run their own commands on your machine) close behind.

Two Bugs Attackers Got to First

What makes this month different from an ordinary large patch batch is that two of the flaws were "zero-days" — security researcher shorthand for a bug that's already being exploited in real attacks before a fix is available, meaning defenders were playing catch-up from day one.

• CVE-2026-85880 — a heap-based buffer overflow (a memory-handling bug) in a Windows component called ALPC, rated 7.8 out of 10 on the CVSS severity scale. An attacker who already has some access to a machine can use it to escalate to full SYSTEM-level control.
• CVE-2026-81963 — a flaw in how the Windows Update Stack resolves file links, also CVSS 7.8, which likewise lets a locally authorized attacker climb to SYSTEM privileges.

Neither needs a stolen password to start with — both assume the attacker already has a toehold, then use the bug to go from limited access to complete control. That's precisely the kind of second-stage move that turns a minor intrusion into a full compromise.

The One Flaw IT Teams Are Actually Losing Sleep Over

The scarier entry on the list, at least on paper, is CVE-2026-73009 — a critical remote code execution bug in Windows' Secure Socket Tunneling Protocol (SSTP) service, carrying a near-maximum CVSS score of 9.8. SSTP is a VPN protocol many organizations use for remote access, and it's typically exposed directly to the internet over port 443 so employees can connect from anywhere. That's what makes this one dangerous: an unauthenticated attacker can send a single crafted network packet to a public-facing SSTP listener and execute code on the server, no credentials or prior foothold required.

A patch that fixes an unauthenticated, internet-facing RCE is not a "get to it next sprint" item — it's a today problem, especially for anything sitting on a public IP.

Microsoft hasn't reported this one as actively exploited yet, but security teams treat "unauthenticated plus internet-facing plus CVSS 9.8" as a countdown clock, not a maybe.

Where This Gets Personal for Indian Companies

This is exactly the scenario India's Computer Emergency Response Team (CERT-In) had in mind when it introduced a tiered patching mandate earlier this year. Under that guidance, government bodies, banks, telecom operators, digital public infrastructure and healthcare and energy providers are expected to contain or fix known-exploited vulnerabilities on internet-facing "crown jewel" systems within 12 hours where feasible — with a one-day window for other critical externally exposed flaws, three days for critical internal ones, and five days for high-severity issues. CERT-In's stated reason was blunt: attackers are increasingly using AI tools to scan for and weaponize exposed flaws far faster than security teams used to have to worry about, so the old "patch within a month" cadence no longer holds.

For an Indian bank or telco running an SSTP-based VPN gateway on the public internet, CVE-2026-73009 is not an abstract CVE number — it's precisely the class of exposure CERT-In's rule is built for, and it puts a hard clock on IT teams that many organizations elsewhere in the world don't face. Smaller Indian startups and IT services firms without a dedicated security operations team may find that clock even harder to meet, which is its own argument for building patch automation into infrastructure from the start rather than treating it as an afterthought.

Record-breaking patch counts tend to get treated as a one-off headline, but the more useful way to read this month is as a preview of the new normal: bigger, more frequent update batches, a growing share of them containing bugs already in active use, and regulators — CERT-In among the first — rewriting their rules around the assumption that attackers now move at machine speed. Whether patching practices at most organizations can keep up is the more interesting question than the raw number 974.