Microsoft released its September Patch Tuesday update for Windows 11, addressing a record-breaking 974 security vulnerabilities. The update covers 723 issues within the Windows product family, with 611 specific to Windows 11 24H2 and 25H2 versions. Users are advised to update to build 26200.9445 or 26100.9445, or verify the installation of KB5124008.
The company reports a significant surge in disclosed vulnerabilities, with 2,779 CVEs identified from January to September 2026, compared to 876 during the same period in 2025. This represents a 217.2% increase. Microsoft attributes this rise to more mature internal AI models for vulnerability detection and increased participation from external researchers.
Critical components patched include Windows Update, Windows Hello, the graphics kernel, and biometric services. Notably, CVE-2026-81963 in the Windows Update Stack is already showing signs of active exploitation. Microsoft now recommends limiting update delays to three days, or two days for zero-day or one-day vulnerabilities, citing the rise of AI-driven cyberattacks.
To further automate security, Microsoft is utilizing a system called MDASH, described as an agentic vulnerability discovery and remediation tool. This system is expected to increase the volume of monthly patches as it identifies more flaws. The company emphasizes that rapid deployment of these updates is essential to mitigate threats from attackers using AI to exploit security gaps.
