What Microsoft’s largest Patch Tuesday update means to security teams

COMMENTARY: Microsoft’s September 2026 Patch Tuesday this week was its largest security update ever, addressing at least 974 vulnerabilities across Windows and other software.

This brings Microsoft’s 2026 total to more than 2,600 vulnerabilities, already more than double its previous annual record.

[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]

The record number grabs headlines, by treating all 974 fixes as equals can burn teams out and see them still miss the flaw that matters.

The most urgent issues include the following:

Two actively exploited zero-days that let attackers gain elevated privileges on Windows systems.
One-hundred-thirteen critical vulnerabilities, some of which could let attackers take complete control of affected machines.
One serious Windows DNS flaw that attackers can potentially exploit remotely without authentication.
A Windows Shell remote-code-execution flaw with a near-maximum CVSS score of 9.8, requiring no user interaction or privileges to exploit.

The two zero-days under active exploitation of course go first on remediation priorities lists. Both are elevations of privilege, which tells us where to start rather than whether to bother. An attacker needs a foothold before either of them are worth anything, so the machines to patch first are the ones where a low privilege foothold becomes full control: servers, jump hosts, shared multi-user systems.

Then look separately at the ways in, because that’s a different question from what’s being exploited today. An unauthenticated attacker can trigger the DNS flaw with a specially crafted packet. The Windows Shell bug carries a 9.8 with low attack complexity, no privileges and no user interaction. Neither was confirmed exploited, but both are unauthenticated paths inward, and Microsoft's own likely exploitation assessment stands as a better prioritization signal than the severity number. Most teams still sort by the number.

After that, focus on what’s actually reachable in the company’s environment. A critical flaw on a server exposed to the internet beats a dozen critical bugs on machines an attacker cannot touch.

Every company in the tech industry faces challenges from the dramatic increases in CVEs. Adobe, Cisco, Google, Mozilla, and Oracle have all credited AI-assisted research with rising patch volume, and Google has just moved to shipping security updates every two weeks.

If vendors are right that AI accelerates discovery, then the volume of findings has grown far faster than the share of them that matter to any one specific organization. Discovery has been automated. Deciding what’s relevant to each security team has not, and that’s now the binding constraint.

Humans are yet another constraint. A patch cannot ship until it has been regression tested against the third-party software running on top of it, and that work lands on a small number of increasingly overloaded people, and frequently outside of normal business hours.

No amount of AI on the discovery side fixes that. If the organization has doubled its patch load without adding anything to the team absorbing it, we have moved the risk rather than reduced it.

Old models fall away

The old model CVSS was simple. Scan, score with CVSS, patch anything above a 7, repeat. It made sense when a few thousand CVEs came out each year. That model no longer holds.

It’s worth remembering that fewer than 5% of published CVEs are ever exploited in the real world. Teams that patch by CVSS severity alone are guessing at which slice of that 5% they landed on.

A study of organizations that patch everything scoring CVSS 7 or higher found that only 2.3% of those “critical” fixes were exploited. That’s a lot of engineering hours spent on flaws that would likely go unexploited, while the ones that mattered sat in the same queue, untouched, ranked no differently.

However, risk-based vulnerability management closes this gap. Instead of asking “how severe is this on paper,” it asks “will this likely get exploited, on this system, tied to this asset, right now.”

Here’s the bottom line: AI helps uncover vulnerabilities at unprecedented speed, and organizations are struggling to keep up with the resulting flood of patches. Teams must now shift from finding vulnerabilities to risk-based prioritization and rapid, safe deployment of the most important fixes.

Waseem Ahmed, head of engineering, Secure.com

SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.