12OCT

Microsoft fixes 973 flaws in one release

2 min read

10:55UTC

Microsoft's September Patch Tuesday fixed 973 flaws in its own products, the most in any monthly release since January 2025.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

Microsoft's 973-fix September release was the largest monthly batch since January 2025.

Microsoft fixed 973 flaws in its own products on 8 September, its Patch Tuesday monthly security release⁠¹. Microsoft assigns Common Vulnerabilities and Exposures (CVE) numbers, the shared reference for a single flaw, to bugs in its own software, so the count is its own. 113 were rated Critical, against 402 in August.

That is the largest count in the 21 monthly releases since January 2025. The next-highest was July 2026 at 571, and no 2025 month passed 170; June's release had fixed about 200.

Two September entries carried Microsoft's exploited flag: Windows Update Stack CVE-2026-81963 and Windows Advanced Local Procedure Call (ALPC) CVE-2026-85880. Both let an attacker already on a machine raise their privileges. CISA, which sets patch deadlines for US federal agencies, gave government departments 14 days for each⁠², the longer of its two common deadlines.

Deep Analysis

In plain English

On the second Tuesday of each month Microsoft releases security fixes for Windows, Office and its other products, known as Patch Tuesday. In September it fixed 973 flaws in its own products, more than twice the August number and far more than any month since at least January 2025. Each flaw gets a reference number called a CVE. Only two of those flaws were known to be under attack already. Both let someone who is already on a Windows computer give themselves more control over it.

Deep Analysis

Root Causes

Microsoft is both vendor and numbering authority for its own products, so how finely it splits fixes into CVEs is an internal choice with no outside check. A change in that practice would raise counts without any change in code quality.

The monthly Patch Tuesday cadence concentrates every fix into one drop. When the underlying flow of reports grows, the single release grows with it rather than spreading across the month.

About two hours after release, a researcher persona called MSNightmare published ShieldCrash, a proof of concept claiming Microsoft's earlier Defender fix for CVE-2026-69414 was incomplete. The Nightmare-Eclipse disclosures show outside researchers pushing Microsoft faster than its cadence allows.

What could happen next?

Consequence
IT teams will lean harder on exploitation flags and outside scoring to choose what to test first, because nobody can review nearly a thousand entries in a monthly window.
Risk
High-severity but unflagged flaws, such as the Windows DNS Server bug, may sit unpatched while teams chase the two exploited entries.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In February 2024 the Linux kernel project became its own CVE numbering authority and began assigning CVE numbers to most bug fixes, pushing its yearly count into the thousands. Downstream Teams answered by triaging on reachability and exploitation rather than raw counts.

Counter-parallel: Also in February 2024, NIST's National Vulnerability Database largely stopped adding severity scores to new CVEs, and a backlog passing 10,000 built up by mid-year. There, volume broke the scoring system that defenders relied on rather than changing how they triaged.

Testing cost scales with the number of affected products and builds, not with headline CVE counts, so the 973 figure overstates the workload for any single estate. It still lengthens the review needed to work out which fixes apply.

Organisations that test every Patch Tuesday release before deployment face either a longer test cycle or more risk accepted without testing. Both cost staff time that the August release, at 402, did not.

Consensus view: Microsoft's own CVRF feed shows the Microsoft-assigned count at 2.4 times August, and CrowdStrike's independent tally of 972 matches it within one, so the volume is real rather than a counting artefact. Microsoft has given no reason for the rise, and its counts have run several times their 2025 level since July.

Counter-view: Volume and danger moved apart. Only two entries carried the exploited flag and both got 14-day federal windows, while CrowdStrike singled out an unflagged Windows DNS Server flaw, CVE-2026-69730, scored 9.8, as the more urgent fix. Japan's JPCERT/CC, which relays Microsoft's monthly releases to Japanese organisations, now has a far larger list to triage for its own audience.

Key tension: Whether Microsoft is finding more flaws or splitting the same fixes into more CVE numbers, a question its silence leaves open.

Sources:CISA·Microsoft

Mentions:Microsoft →CISA →Known Exploited Vulnerabilities →NIST →CrowdStrike →Japan →JPCERT/CC →Patch Tuesday →Common Vulnerabilities and Exposures →National Vulnerability Database →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

CISA· 12 Oct 2026

Read original →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.