Microsoft Plugs Nearly 1,000 Security Holes
Microsoft's September Patch Tuesday fixes a record 974 flaws, including two actively exploited Windows zero-days and critical DNS and Windows Shell bugs.
Microsoft released fixes for 974 vulnerabilities, its largest-ever monthly patch batch, bringing the 2026 total above 2,600. Two zero-day privilege elevation flaws, CVE-2026-81963 and CVE-2026-85880, are being actively exploited. Critical bugs include CVE-2026-69730, an unauthenticated DNS weakness in Windows Server 2012 onward and Windows 10 deemed likely to be exploited, and CVE-2026-69829, a CVSS 9.8 Windows Shell remote code execution flaw requiring no privileges or user interaction. Microsoft and other vendors credit AI-assisted discovery for the growing patch volumes.
- Record 974 vulnerabilities fixed this month; 113 rated critical
- CVE-2026-81963 and CVE-2026-85880 are actively exploited Windows privilege elevation zero-days
- CVE-2026-69730 DNS flaw is exploitable via a crafted packet and likely to be exploited
- CVE-2026-69829 Windows Shell RCE scores 9.8 CVSS with no privileges or interaction required
- Vendors including Google and Adobe cite AI-assisted discovery for rising patch cadence
- Products
- WindowsWindows Server
- Organizations
- SANS Internet Storm Center
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-69730+1 related CVE | Use-After-Free RCE in Windows DNS Server | 9.8 | 1% | ||
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
From the original article
3 min read at krebsonsecurity.com
Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever.
By BrianKrebs · krebsonsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.