Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Microsoft released a record-breaking 974 security patches on Tuesday, including fixes for two zero-day vulnerabilities that attackers are already exploiting in the wild. The sheer volume of Common Vulnerabilities and Exposures (CVEs) addressed in the September 2026 update shatters previous records, presenting a significant deployment challenge for IT administrators globally.[1][2][4]

The massive patch load is largely attributed to Microsoft's recent deployment of advanced AI-assisted vulnerability detection tools within its internal security review processes. These tools have significantly increased the rate at which flaws are identified across the company's vast codebase, leading to the unprecedented number of fixes in a single monthly cycle.[7]

Among the 974 flaws, 113 are rated as "Critical," the highest severity level, indicating that they could allow remote code execution or significant system compromise without user interaction. The remaining vulnerabilities are classified as "Important" or "Moderate."[9]

The most urgent fixes address two zero-day vulnerabilities currently under active exploitation. The first, tracked as CVE-2026-38112, is a Windows MSHTML Platform Spoofing Vulnerability. This flaw allows an attacker to execute arbitrary code by convincing a user to open a specially crafted file or visit a malicious website.[1][2][3]

The second actively exploited zero-day, CVE-2026-38831, is a Windows Mark of the Web (MotW) Security Feature Bypass Vulnerability. This flaw enables attackers to bypass security warnings that normally appear when a user attempts to open a file downloaded from the internet, facilitating the delivery of malware.[1][2][5]

Security researchers emphasize the critical need for immediate patching, particularly for the two zero-days. "The sheer volume of CVEs this month is staggering, but the immediate focus must be on the two exploited zero-days," noted analysts at Qualys in their review of the update. "Organizations need to prioritize these patches to mitigate the immediate risk of compromise."[8]

The update also includes patches for a wide range of Microsoft products, including Windows, Office, Exchange Server, and Azure components. The extensive list of affected software underscores the broad impact of the September Patch Tuesday and the necessity for comprehensive update strategies.[6][8]

While the AI-driven discovery of vulnerabilities has led to a record number of patches, it also highlights a proactive approach to identifying and addressing security flaws before they can be widely exploited. However, the resulting patch burden on IT departments remains a significant operational challenge.[7][9]