22OCT

Microsoft fixes 973 flaws in one release

2 min read

16:31UTC

Microsoft's September Patch Tuesday fixed 973 flaws in its own products, the most in any monthly release since January 2025.

← Back to Fridge hack spoils food in seven countries Jump to analysis ↓

TechnologyAssessed

Key takeaway

Microsoft's 973-fix September release was the largest monthly batch since January 2025.

Microsoft fixed 973 flaws in its own products on 8 September, its Patch Tuesday monthly security release⁠¹. Microsoft assigns Common Vulnerabilities and Exposures (CVE) numbers, the shared reference for a single flaw, to bugs in its own software, so the count is its own. 113 were rated Critical, against 402 in August.

That is the largest count in the 21 monthly releases since January 2025. The next-highest was July 2026 at 571, and no 2025 month passed 170; June's release had fixed about 200.

Two September entries carried Microsoft's exploited flag: Windows Update Stack CVE-2026-81963 and Windows Advanced Local Procedure Call (ALPC) CVE-2026-85880. Both let an attacker already on a machine raise their privileges. CISA, which sets patch deadlines for US federal agencies, gave government departments 14 days for each⁠², the longer of its two common deadlines.

Deep Analysis

In plain English

On the second Tuesday of each month Microsoft releases security fixes for Windows, Office and its other products, known as Patch Tuesday. In September it fixed 973 flaws in its own products, more than twice the August number and far more than any month since at least January 2025. Each flaw gets a reference number called a CVE. Only two of those flaws were known to be under attack already. Both let someone who is already on a Windows computer give themselves more control over it.

Deep Analysis

Root Causes

Microsoft is both vendor and numbering authority for its own products, so how finely it splits fixes into CVEs is an internal choice with no outside check. A change in that practice would raise counts without any change in code quality.

The monthly Patch Tuesday cadence concentrates every fix into one drop. When the underlying flow of reports grows, the single release grows with it rather than spreading across the month.

About two hours after release, a researcher persona called MSNightmare published ShieldCrash, a proof of concept claiming Microsoft's earlier Defender fix for CVE-2026-69414 was incomplete. The Nightmare-Eclipse disclosures show outside researchers pushing Microsoft faster than its cadence allows.

What could happen next?

Consequence
IT teams will lean harder on exploitation flags and outside scoring to choose what to test first, because nobody can review nearly a thousand entries in a monthly window.
Risk
High-severity but unflagged flaws, such as the Windows DNS Server bug, may sit unpatched while teams chase the two exploited entries.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In February 2024 the Linux kernel project became its own CVE numbering authority and began assigning CVE numbers to most bug fixes, pushing its yearly count into the thousands. Downstream Teams answered by triaging on reachability and exploitation rather than raw counts.

Counter-parallel: Also in February 2024, NIST's National Vulnerability Database largely stopped adding severity scores to new CVEs, and a backlog passing 10,000 built up by mid-year. There, volume broke the scoring system that defenders relied on rather than changing how they triaged.

Testing cost scales with the number of affected products and builds, not with headline CVE counts, so the 973 figure overstates the workload for any single estate. It still lengthens the review needed to work out which fixes apply.

Organisations that test every Patch Tuesday release before deployment face either a longer test cycle or more risk accepted without testing. Both cost staff time that the August release, at 402, did not.

Consensus view: Microsoft's own CVRF feed shows the Microsoft-assigned count at 2.4 times August, and CrowdStrike's independent tally of 972 matches it within one, so the volume is real rather than a counting artefact. Microsoft has given no reason for the rise, and its counts have run several times their 2025 level since July.

Counter-view: Volume and danger moved apart. Only two entries carried the exploited flag and both got 14-day federal windows, while CrowdStrike singled out an unflagged Windows DNS Server flaw, CVE-2026-69730, scored 9.8, as the more urgent fix. Japan's JPCERT/CC, which relays Microsoft's monthly releases to Japanese organisations, now has a far larger list to triage for its own audience.

Key tension: Whether Microsoft is finding more flaws or splitting the same fixes into more CVE numbers, a question its silence leaves open.

Sources:CISA·Microsoft

Mentions:Microsoft →CISA →Known Exploited Vulnerabilities →NIST →CrowdStrike →Japan →JPCERT/CC →Patch Tuesday →Common Vulnerabilities and Exposures →National Vulnerability Database →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

CISA· 12 Oct 2026

Read original →

Causes and effects

This Event

Microsoft fixes 973 flaws in one release

A release of nearly 1,000 fixes forces patch teams to book change windows before they can judge which fixes matter.

Led to

Microsoft lists 1,456 of its own CVEs

Microsoft's October document follows September's 973-CVE Patch Tuesday.

Occurred 13 Oct 2026

Read story →

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.