The first problem with Microsoft's record September patch haul is that its headline number changes with the counting rule. Microsoft's current machine-readable bulletin says the release contains 974 Microsoft CVEs and separately republishes 25 non-Microsoft CVEs. The Zero Day Initiative review counts 972 new Microsoft CVEs, or 997 after external and Chromium issues are included. The 25-CVE swing is an accounting issue. Defenders have a more immediate problem: two Windows privilege-escalation flaws were already being exploited when the fixes arrived, and ZDI found 20 remote-code-execution patches it considers potentially wormable. For defenders, the useful question is which bugs can reach their machines. Settling on one total comes later.
One release, several defensible totals
The difference starts with scope. Microsoft's September document labels 974 CVEs as Microsoft issues, then puts the 25 republished non-Microsoft CVEs in a separate line. Its product table assigns 723 vulnerabilities to Windows, 111 to Office, 62 to SQL, 22 to developer tools and smaller totals to other families. Those rows cannot be added into a unique-CVE total because a flaw may affect more than one product family, a distinction visible in the official release data.
ZDI used a different boundary: 972 new CVEs from Microsoft and 997 once external and Chromium entries were counted. It classified 114 of the new issues as critical. Ars Technica's report used roughly 972 and 112 critical. The two reports agree that the release is a record, yet their critical totals differ by two. A security report that records only a bare monthly number will be hard to reproduce later unless it also records the source, snapshot time, inclusion rule and document revision.
The release is large under any of those definitions. Microsoft's affected-product list covers supported Windows clients and servers, Office, Exchange, SQL Server, .NET, Visual Studio, cloud services and mobile apps. ZDI's inventory also includes network roles such as DNS, DHCP, Active Directory and Remote Desktop. That breadth describes the testing and deployment burden better than one total does, because no organization runs every product in the September inventory.
The exploited bugs sit below the critical tier
Microsoft marked two issues as exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call. Both have a CVSS base score of 7.8 and sit in Microsoft's Important tier. CISA added both to its Known Exploited Vulnerabilities catalog on September 8 and set September 22 as the remediation deadline for US federal civilian agencies, according to the agency's machine-readable KEV feed. The deadline is jurisdiction-specific; the evidence of exploitation is useful everywhere.
CVE-2026-81963 is a link-following and access-control error in the Windows Update Stack. Microsoft's assessment says an authorized local attacker can elevate privileges and, after successful exploitation, gain SYSTEM rights. The CVSS vector requires local access and low privileges, with no user interaction. At release, Microsoft listed public disclosure as No and exploitation as Yes.
CVE-2026-85880 is a heap-based buffer overflow in Windows ALPC. Microsoft says code already running in a low-privilege AppContainer can use it to escape that sandbox and elevate privileges without further user action. Successful exploitation can also reach SYSTEM. Like the Update Stack bug, it requires local code execution and cannot be used as a direct remote entry point. Microsoft's record marked exploitation as Yes and public disclosure as No.
Because both flaws require a foothold, an attacker would normally use either one after gaining local code execution. The escalation can then break out of a restricted process or grant broader control. ZDI researcher Dustin Childs wrote that the Update Stack issue would probably be paired with a code-execution flaw, though Microsoft has not published who is using it or how widely. The vendor records and ZDI analysis support urgent patching without suggesting that an unauthenticated attacker can reach every Windows machine directly through these two bugs.
Exposed servers can reorder the queue
For organizations operating Exchange on their own servers, CVE-2026-55007 may demand an equally fast maintenance window. Microsoft's Exchange advisory describes an 8.1-rated double-free flaw that lets an unauthenticated attacker send a crafted Visio attachment. Exchange can process it during content indexing, so the attack needs no click or preview. Exploitation is difficult because the server must be under sustained memory pressure, and Microsoft rates exploitation as less likely. The combination of network reach, no credentials and no user action still makes exposure more informative than the Important label alone.
Remote Desktop Services has the opposite scoring oddity. CVE-2026-69525 carries a 9.8 CVSS score while Microsoft rates it Important. The use-after-free bug can give an unauthenticated in-network attacker remote code execution by calling arbitrary endpoints. Microsoft labels exploitation more likely, although it had seen neither public disclosure nor active exploitation at release. A Remote Desktop service reachable by untrusted networks therefore belongs ahead of a higher-scored flaw in a product the organization does not deploy.
Childs identified 20 September patches that could qualify as wormable because they permit remote, unauthenticated code execution without user interaction. His list spans DHCP, Active Directory Domain Services, DNS Server, Message Queuing, Netlogon, failover clustering and other Windows network components. Could qualify is doing work here: ZDI is describing the conditions for automated spread, not reporting a self-spreading exploit in circulation. Service state and network reachability determine whether that capability is usable.
A single score-sorted queue is weak. The two known-exploited bugs deserve an immediate endpoint pass, while internet-facing Exchange and reachable Remote Desktop systems need their own exposure pass. Internal infrastructure then needs a service-level review for the 20 potential propagation paths. Microsoft's exploit flags and technical vectors, together with ZDI's network analysis, provide the evidence for that order. The headline count adds no exposure data.
The AI story needs a narrower claim
Ars connected the surge in patches to faster AI-assisted vulnerability discovery and to an industry warning about AI-enabled attacks. The underlying open letter says such attacks will become more widespread and sophisticated in the coming months. Its signatories, including Microsoft and several AI and security companies, call for faster repair of high-risk weaknesses and verified compensating controls where patching would disrupt essential services. The letter is a forecast and policy position. It offers no evidence that AI found or exploited every bug in September's release.
ZDI writes that AI-assisted discovery is accelerating. Researchers have yet to see a matching rise in active exploits, Childs added. Microsoft's September bulletin catalogs products, severity, exploitability and fixes without attributing all 974 Microsoft CVEs to one discovery method. The record count can reflect more discovery and disclosure capacity, changes in scope, or both. A causal claim tying every entry to AI lacks vendor support.
One flaw does have a direct AI-shaped attack path. CVE-2026-65669 is a critical 9.6-rated SQL Server injection issue involving SQL Copilot in SQL Server Management Studio. Microsoft says an attacker could persuade a user to submit crafted instructions to the assistant, bypass intended read-only restrictions, and access or change database data with the connected user's permissions. User interaction is required, exploitation is rated less likely, and Microsoft had not detected exploitation. It is a concrete example of an AI interface extending an old trust-boundary problem into a new input path.
Turn the bulletin into an inventory check
The first deployment check is whether supported Windows systems received the September cumulative update and completed any required restart. Microsoft says its Windows 10 and Windows 11 monthly packages include the applicable security fixes, while the release notes link separate updates and known-issue entries for Exchange, SQL Server and Windows Server. A management console showing an update as assigned is weaker evidence than the patched build running on the device.
Server owners have a different job. They need to match Exchange versions, Remote Desktop roles, DNS, DHCP, domain controllers and Message Queuing against the affected products, then test the relevant package in the order set by exposure. The MSRC Exchange record identifies the attack path, while ZDI's review supplies the propagation-oriented shortlist. Systems that cannot be patched immediately need verified isolation or access restrictions. The update should still have a scheduled maintenance window.
The 25 republished non-Microsoft CVEs also deserve a separate inventory pass. Microsoft's bulletin labels them separately from its 974 Microsoft CVEs, so teams should not assume that one Windows cumulative package resolves every item shown in the broader release document. Tracking vendor ownership prevents a third-party or Chromium-related entry from disappearing inside a Microsoft Patch Tuesday ticket that is later marked complete, as the official scope statement makes clear.
Microsoft can revise individual CVE records as affected versions and exploitability information change. At publication, the CISA feed contains the two Windows privilege-escalation bugs, while ZDI reports no observed self-spreading attack for its 20 potentially wormable candidates. The next facts worth watching are additions to the exploited list, working exploit reports for the exposed server flaws, revisions to affected-product data, and changes to vendor mitigations. Any of those would change the patch order. The 972-versus-997 debate leaves that order unchanged.