From 570 bugs in July to 974 in September, Microsoft's Patch Tuesday delivered a step-jump in monthly fixes over just three months. With this September release, the 2026 cumulative patch count has crossed 2,600—already more than double the previous full-year record of 1,245 set in 2020—and three months remain on the calendar.
What Is Actually Dangerous in This Batch
Of the 974 patches, 113 carry Microsoft's "critical" rating. Two zero-day vulnerabilities—CVE-2026-81963 and CVE-2026-85880—are being actively exploited in the wild, both tied to privilege escalation. The one worth singling out is CVE-2026-69730, a DNS flaw affecting Windows Server 2012 onward as well as Windows 10: an unauthenticated attacker can trigger it by sending a single crafted packet. The other is CVE-2026-69829, a Windows Shell remote code execution bug with a CVSS base score of 9.8—low attack complexity, no privileges required, no user interaction needed.
Is AI the Reason Behind the Patch Flood
Microsoft stated in its advisory that AI is accelerating vulnerability discovery. Krebs on Security's reporting draws an important cross-vendor comparison: Adobe, Cisco, Google, Mozilla, and Oracle have all recently attributed faster patch cadence and bigger bundle sizes to AI-assisted research—Google this week even announced that Chrome security updates will now ship every two weeks.
But Satnam Narang, senior staff research engineer at Tenable, offers a different read: "AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn't finding more needles." His point: most CVEs being discovered are not actually reachable or exploitable for most organizations. The CISO's real job is to prioritize based on reachability and exploitability, not to be crushed by a thousand-line monthly bulletin.
Enterprise IT Teams Are Already Drowning
Tyler Reguly, associate director of security research and development at Fortra, put it bluntly: "It's time to put our CISOs and CSOs on notice. How much can your budget buy in Saturday-night pizza?" His meaning: the operations teams inside enterprises who test and deploy patches are being worn down by the monthly patch flood.
This isn't Microsoft's problem alone—Adobe, Cisco, and Oracle released giant patch bundles the same month. A few hundred extra CVEs per month sounds like progress in security research, but when maintainers have to handle hundreds of PRs each week, and Linux kernel maintainers are being squeezed by "close to 2,000 CVEs" surfaced by AI tools to the point of actively deleting legacy drivers just to keep pace, this victory increasingly looks like a pyrrhic one.
So What
AI has lowered vulnerability discovery to a "scan-everything-monthly" level, but enterprise-side remediation capacity hasn't grown in step. When patch counts jump from 1,245 to over 2,600, the real beneficiaries aren't attackers (who already have N-day toolchains) but zero-day exploits that fire first—the gap between those two curves is the true cost of enterprise security in 2026.
Reference: Krebs on Security, "Microsoft Plugs Nearly 1,000 Security Holes" (https://krebsonsecurity.com/2026/09/microsoft-plugs-nearly-1000-security-holes/).