Microsoft Fixes 974 Flaws in September Update, a Record High

Microsoft has released its September routine security update, fixing a total of 974 flaws. The cumulative number of fixes for the year has exceeded 2,600, setting a record for a monthly update. According to Solidot, AI-assisted flaw discovery has contributed to the sharp increase in fixes. This update includes two zero-day vulnerabilities with confirmed exploitation. Corporate operations and development teams are now being forced to determine patching priorities.

Routine updates are published on the second Tuesday of each month. This release is several times larger than usual, with a major impact on operations. The fixes cover Windows itself and related components, as well as server product lines. Administrators need to identify the affected scope and proceed with verification in a short period. Attack activity tends to intensify immediately after disclosure, making a rapid initial response critical.

It fixed a total of 974 bugs. This is a record high, and the number of security patches this year has already exceeded 2,600.

As the above quote shows, the volume has entered a new stage. This is not a one-off surge in fixes, but a continuing upward trend throughout the year. There is growing evidence that this change is not a temporary spike.

Breakdown and Severity of the 974 Fixes in

the September Update

Of the 974 flaws fixed this time, elevation of privilege was the largest category with 438 cases. Remote code execution followed with 258 cases, and information disclosure with 173 cases. There were 56 denial-of-service cases, 19 security feature bypasses, and 16 spoofing cases. Defects rated as high severity totaled 113. Elevation of privilege and remote execution together account for more than 70% of the total.

Elevation-of-privilege flaws are often used to expand activity after an initial intrusion. Malicious code executed with low privileges can become a path to seizing administrator rights. The figure of 438 shows the reality that perimeter defense alone is difficult to contain. The need for layered defense that assumes lateral movement inside the network is growing. Strict privilege management and least privilege remain important measures.

The 258 remote code execution cases can lead to direct attacks from outside. The 173 information disclosure cases could lead to leaks of credentials and internal documents. The 56 denial-of-service cases impair availability and can cause business outages. The 16 spoofing cases can be abused to fake legitimate communications or displays. Not only the number but the spread across types is increasing the burden on defenders.

The 113 high-severity cases should be prioritized for patching. Organizations need to cross-reference public information with their asset inventories and address highly exposed systems first. Because procedures differ for servers and endpoints, a division of responsibilities is also required. Regression testing in a test environment and phased rollout are practical steps. It is essential to proceed with updates with a recovery plan in place.

Details of the Actively Exploited Zero-Day

Vulnerabilities

This update includes two elevation-of-privilege zero-day vulnerabilities. They are identified as CVE-2026-81963 and CVE-2026-85880. Both have confirmed exploitation, giving them the highest priority. Elevation of privilege alone does not establish an intrusion. However, it plays a decisive role in expanding damage after intrusion.

Zero-day vulnerabilities refer to flaws for which attack methods circulated before a fix. When combined with detection evasion and persistence, they become difficult to remove. The two cases this time are classified as elevation of privilege and are used to seize administrator rights. Processes executed as standard users could be re-executed with higher privileges. Behavior monitoring on endpoints and logging of privilege use are effective.

Reporting by Krebs on Security covered the scale of this update and the two zero-days. Solidot also cited the same content, introducing the breakdown and serious individual cases. Primary information is consolidated in Microsoft’s security update guidance. Administrators need to judge based on both the vendor’s severity ratings and exposure. Cases with confirmed exploitation invariably require immediate action.

Companies must decide the order of application with each monthly update. When zero-day vulnerabilities are present, deployment should be moved up without waiting for the regular window. Identify the affected OS versions and roles, and prioritize externally exposed systems. Apply patches after taking backups and verify that authentication infrastructure works. Afterward, it is advisable to check logs for suspicious privilege changes.

Serious Flaws Remaining in DNS and Shell

A notable individual case is the DNS vulnerability CVE-2026-69730. It is said to affect Windows Server 2012 and later and Windows 10. An unauthenticated attacker can exploit it simply by sending crafted packets. DNS is central to name resolution, so the impact can spread widely. Domain controllers and internal resolution infrastructure require particular attention.

Disruption or spoofing of DNS infrastructure can also affect authentication and mail delivery. A single flaw could cascade across multiple business systems. Limiting reachability from outside and strengthening monitoring are effective. Close unnecessary external exposure and isolate communications between internal segments. Mitigations before patching and operational checks after patching must proceed together.

The other case is the Windows Shell code execution flaw CVE-2026-69829. Its threat score is given as 9.8, indicating exploitation is extremely easy. Shell is closely tied to user actions and is easily used in lure-based attacks. Viewing attached documents or lured destinations can trigger execution. Endpoint defenses must be combined with user education.

A score of 9.8 is near the highest level in severity ratings. Factors such as no authentication required and low attack complexity push the rating up. Once proof-of-concept methods circulate after disclosure, the bar for attacks drops further. Isolated execution, privilege suppression, and Protected View for documents help reduce damage. Coordination between email path defenses and endpoint detection is also important.

Growing Vulnerability Workload Driven by AI

Assistance

With AI now assisting flaw discovery, the number of monthly fixes is trending upward. Automated analysis is uncovering types of bugs previously missed. Expanded fuzzing and static analysis are boosting detection efficiency. As a result, vendors’ fixing processes and users’ patching processes are expanding. Improved discovery itself is a change that benefits defense.

At the same time, the growing number of fixes is straining verification resources on the operations side. It is not realistic to examine all 974 items in a short period. Narrowing down by severity, exploitation status, and asset exposure is essential. Properly balancing automatic updates and manual verification is key to stable operations. Keep change-management records and clarify rollback procedures.

Development processes are also affected. Underlying platforms they depend on are updated more frequently, increasing compatibility checks. Testing for platform updates must be built into continuous integration and continuous deployment pipelines. Template updates for container platforms and virtual machines must also be done without delay. A system to enforce version control across the entire supply chain is required.

Disclosure operations on the vendor side are also a challenge. Issuing large numbers of identifiers and preparing documentation burden quality maintenance. Consistency of severity ratings and accuracy of mitigation descriptions are tested. Users need to ingest vendor information in machine-readable formats. Integration between asset inventories and vulnerability inventories determines response speed.

Editorial Opinion

On short-term impact: Over the next three to six months, the burden of update verification on companies is expected to increase. Updates on the scale of 974 items will push up test items and extend phased rollout periods. Automation of prioritization and improvement of asset inventories are expected to advance. The two cases with confirmed exploitation will prompt decisions to apply patches ahead of schedule.

On the long-term view: Over one to three years, AI-assisted detection is expected to remain at a high level. Monthly update volumes may remain persistently high. Vendors will be pressed to streamline fixing processes and maintain disclosure quality. For users, design premised on continuous updates and securing recovery procedures will be essential.

A question from the editors: The remaining issue is how to evaluate the rising number of fixes. It is difficult to tell whether it reflects improved discovery or growing product complexity. The paradox that large volumes of fixes cause patching delays also remains. The line between what to leave to automation and what to leave to human judgment is being questioned.

References

• “微软九月例行更新修复近千个 Bug”, by (author unknown) — Solidot, 2026-09-10T11:42:20.000Z (ARR)
• Source URL: https://www.solidot.org/story?sid=85338