Microsoft's September patch covers 972 flaws, a record

Microsoft's September patch batch covers roughly 972 vulnerabilities, the largest count the company has shipped in a single cycle. The exact number depends on who's counting: Microsoft's own release notes say 974, the Zero Day Initiative logged 972, BleepingComputer counted 966, and Tenable put it at 964. About 112 of them are rated critical, per Ars Technica.

The count discrepancy isn't a rounding error. Different vendors draw the boundary of "this patch" differently. That matters if you're reconciling your own vulnerability scanner's output against a headline number and it doesn't match.

What matters more than the total is which two bugs are already in the wild. CVE-2026-81963, an elevation-of-privilege flaw in the Windows Update Stack, and CVE-2026-85880, an elevation-of-privilege flaw in Windows ALPC, are both under active exploitation. CISA added both to its Known Exploited Vulnerabilities catalog on September 9, 2026, the day the patch went out. For federal agencies that starts a mandatory remediation clock. For everyone else it's the clearest signal in the pile about where to start.

The order that matters

With 112 critical bugs in one release, most teams can't triage all of them fast. Elevation-of-privilege bugs in core OS plumbing like the update stack and ALPC are especially bad because they turn a foothold into full control, and these two are confirmed exploited, not theoretical. Patch those two first, then work down by severity. The rest of the pile can wait a few days. These two can't.