Why this month's Microsoft patch release is a doozy
Microsoft fixed roughly 972 vulnerabilities in September, including 112 critical flaws and two zero-days, underscoring escalating AI-assisted discovery, heavier patching workloads and potentially higher security costs for technology companies.
Microsoft’s September security release fixed roughly 972 vulnerabilities, a record that exceeds the 570 patched two months earlier and approximately 620 addressed last month. Including Chromium fixes incorporated into Edge, Zero Day Initiative researcher Dustin Childs counted 997 fixes. Of the new vulnerabilities, 112 were critical and the remainder important. Microsoft has fixed 2,760 vulnerabilities this year, more than double last year’s total. At this pace, it will fix more bugs this year than in 2023, 2024 and 2025 combined. The release included two zero-days: CVE-2026-81963 in the Windows update service and CVE-2026-85880 in Windows Advanced Local Procedure. No public information identifies who is exploiting them or how widely. Other notable flaws included CVE-2026-55007 in Exchange Server, which enables remote, unauthenticated code execution through a malicious Visio attachment; CVE-2026-80097, a Microsoft Authenticator local privilege-escalation flaw in the authentication system; CVE-2026-69465, involving roughly 17 Office SharePoint remote-code-execution vulnerabilities; CVE-2026-65669, one of 60 SQL Server privilege-escalation flaws exploitable through SQL Copilot instructions; and CVE-2026-69525, a Remote Desktop Services remote-code-execution flaw rated 9.8. Childs said he found so many wormable vulnerabilities—flaws requiring no user interaction and capable of spreading between machines—that he stopped counting at 20. He called the surge in patching the “new normal,” while warning that AI-assisted vulnerability discovery continues to accelerate, even though active exploits have not yet shown a corresponding increase. OpenAI, Anthropic, Amazon Web Services, Google, Microsoft and 100 other organizations recently warned that the patching window is narrowing ahead of an expected wave of AI-enabled attacks. Critics question the expense and false-positive rate of large language models, but Mozilla said in May that its Mythos system found 271 vulnerabilities with almost none classified as false positives. For investors, rising discovery and patching workloads represent both a security necessity and a potential cost pressure. The technology’s long-term effectiveness may take a year or more to assess.