Microsoft’s September 2026 Patch Tuesday has created an unusually large workload for Windows and enterprise security teams: researchers counted 974 unique vulnerabilities across Microsoft products, while two Windows flaws were already being exploited when the fixes arrived.
The sheer number is attention-grabbing, but the practical job for administrators is not to treat all 974 issues as equally urgent. The first priority is to identify the vulnerabilities that are actively exploited, reachable in a particular environment, capable of serious impact and relevant to business-critical systems.
Two Windows vulnerabilities were already being exploited
The most urgent September fixes include CVE-2026-85880 and CVE-2026-81963. Both are Windows privilege-escalation vulnerabilities that can allow an attacker who already has some access to gain SYSTEM-level privileges.
CVE-2026-85880 affects Windows Advanced Local Procedure Call, or ALPC. Microsoft’s description says an attacker able to execute code in a low-privilege AppContainer could exploit the flaw locally to escape that sandbox and elevate privileges.
CVE-2026-81963 affects the Windows Update Stack and involves improper link resolution before file access. Security researchers report that successful exploitation can also result in SYSTEM-level privileges.
The US Cybersecurity and Infrastructure Security Agency has added the two flaws to its Known Exploited Vulnerabilities catalogue, which is designed to help organisations prioritise vulnerabilities that are confirmed to have been used in real attacks.
Why 974 fixes does not mean 974 equal emergencies
Dark Reading and SecurityWeek both reported 974 Microsoft CVEs in the September release, covering a wide range of products including Windows, Office, SQL Server, developer tools, SharePoint, Azure and Exchange Server.
For security teams, the practical lesson is that raw vulnerability counts are a poor patching strategy. A flaw that is actively exploited on an internet-facing or business-critical system should normally move ahead of a vulnerability that affects software an organisation does not run or that is not reachable in its environment.
That means teams should combine Microsoft’s severity and exploitability information with their own asset inventory, exposure data and compensating controls rather than simply working down a list by CVE number.
Start with what is exploited and exposed
A sensible triage sequence for the September release is:
- Patch the two known exploited vulnerabilities first on affected Windows systems, especially devices that are high value or already exposed to other attack paths.
- Identify remotely reachable vulnerabilities in services such as Exchange, Remote Desktop Services, SharePoint, SQL Server and other externally accessible products used by the organisation.
- Prioritise privileged and business-critical systems, including domain infrastructure, management servers, jump hosts and systems handling sensitive data.
- Test updates on representative systems before broad rollout where business continuity requirements make that necessary.
- Track Microsoft’s release-health notices for regressions and follow-up fixes after deployment.
This approach does not reduce the importance of routine patching. It simply recognises that a release this large requires risk-based ordering rather than treating every item as identical.
Microsoft issued follow-up out-of-band Windows updates
The September cycle also illustrates why patch management does not end when the monthly update is installed. Microsoft released out-of-band Windows updates on 14 September to address several problems associated with the September security updates.
For supported Windows 11 releases, Microsoft says the out-of-band update fixed instability affecting Remote Desktop Services that could cause RDP connection and sign-in failures or leave servers unresponsive during Remote Desktop configuration. It also addressed a Hyper-V issue affecting some applications using HCS-managed Linux virtual machines with Plan9 shared folders.
The same out-of-band update fixed one multichannel USB Audio Class 1.0 problem involving 8-channel or 3D audio modes, although Microsoft notes that other USB audio symptoms were not completely resolved at the time of publication.
The update also includes protection for CVE-2026-62721, a Windows User-Mode Power Service elevation-of-privilege vulnerability.
What this means for smaller IT teams
Large enterprises may have dedicated vulnerability-management platforms and teams that continuously calculate exposure and business risk. Smaller organisations often have to make the same decisions with fewer tools.
A lightweight process can still work: maintain a current list of important systems, know which Microsoft products are exposed to the internet, monitor CISA’s KEV catalogue and Microsoft’s Security Update Guide, and separate emergency patching from the normal maintenance cycle.
For a small business, the immediate question should be less “Have we installed all 974 fixes today?” and more “Which affected systems could an attacker realistically reach, and which confirmed exploited flaws must be closed first?”
FlyingEze recently covered broader cybersecurity risks facing small businesses , where limited staff and weak preparation can make even straightforward security incidents disproportionately disruptive.
Why patch volume is becoming a management problem
The September release continues a year of unusually large Microsoft vulnerability counts. Security researchers have linked part of that increase to greater use of automated and AI-assisted vulnerability discovery, which can surface more flaws for vendors to fix.
That is positive from a software-security perspective, but it puts more pressure on administrators to distinguish high-risk vulnerabilities from background patch volume. The challenge is increasingly not just finding vulnerabilities; it is deciding which ones matter most in a specific environment.
That same need for careful oversight is visible elsewhere in modern cybersecurity. FlyingEze also examined Google’s Gemini cybersecurity tests , where more capable automated systems created new operational and safety questions.
Bottom line
Microsoft’s September 2026 Patch Tuesday is notable for scale, but the priority is clear: address the two vulnerabilities already being exploited, identify high-impact flaws that are actually reachable in your environment, test and deploy the relevant Windows and server updates, and monitor Microsoft’s out-of-band releases for post-patch issues.
The headline is 974 vulnerabilities. The operational lesson is prioritisation.
