Microsoft released a record-breaking 974 security patches in September 2026. Among these, 113 vulnerabilities were classified as critical, potentially allowing for remote code execution without user interaction.
Since the beginning of 2026, the company has addressed over 2,600 vulnerabilities, significantly exceeding the previous annual record of approximately 1,250 set in 2020. The previous monthly high was 570 patches in July 2026.
Experts attribute the increased detection rate to the use of artificial intelligence in security research. While AI can also assist in developing exploits, there is currently no evidence of a corresponding surge in mass attacks.
Two critical vulnerabilities, CVE-2026-69730 and CVE-2026-69829, received a CVSS score of 9.8 out of 10. These flaws affect Windows DNS services and the Windows shell, enabling remote code execution.
The update also addresses two zero-day vulnerabilities, CVE-2026-81963 and CVE-2026-85880, which have already been exploited in the wild to escalate user privileges to the System level.
