Dispatch
Microsoft's September patch is the largest on record at roughly 972 CVEs, with two zero-days already exploited
The 8 September release fixes around 972 vulnerabilities with about 112 critical, though counts differ by who is tallying: Microsoft's own notes say 974, ZDI logged 972, BleepingComputer 966, Tenable 964. Two are under active exploitation and went into CISA's Known Exploited Vulnerabilities catalog the same day: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows ALPC, both elevation of privilege. Ars Technica frames the volume as vendors front-loading patches ahead of expected AI-assisted exploitation.
Source
↳ Follow the thread