“AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn’t finding more needles,” Satnam Narang said — a concise warning that arrived the same day Microsoft released fixes for at least 974 security holes, by far its largest single patch bundle ever.
Microsoft's September update: scale, records, and severity
Microsoft Corp. issued updates that address at least 974 vulnerabilities across Windows and other products, eclipsing the company’s previous single-month record of 570 vulnerabilities set in July. The September release brings Microsoft’s total for the year to more than 2,600 — more than double the company’s prior record-setting year of 2020, when it patched 1,245 issues — and it arrives with three more months left in the year.
Of the September fixes, 113 earned Microsoft’s “critical” rating, meaning they could be used by malware or attackers to seize control of affected Windows machines with little or no user interaction. Microsoft also stated that artificial intelligence is helping to speed the discovery of vulnerabilities.
Two zero-days: CVE-2026-81963 and CVE-2026-85880
The September bundle included two “zero-day” flaws that Microsoft said are being actively exploited: CVE-2026-81963 and CVE-2026-85880. Both allow an attacker to elevate privileges on a Windows system, a capability attackers commonly use after initial access to expand control.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogCVE-2026-69730 and CVE-2026-69829: DNS weakness and a near-maximum RCE
Among the most serious critical issues patched were a DNS protocol weakness and a high-scoring remote code execution (RCE) flaw. CVE-2026-69730 affects Windows Server 2012 onward and Windows 10; Microsoft warned that an unauthenticated attacker could leverage the vulnerability by sending a specially crafted packet to an affected system and said the flaw is likely to be exploited.
CVE-2026-69829 is a critical RCE in the Windows Shell with a CVSS base score of 9.8 (10 is the most severe). Microsoft characterized this vulnerability as having low attack complexity, requiring no privileges and no user interaction to exploit — the combination that most concerns defenders and increases the urgency for patching.
AI-assisted discovery and a faster patch cadence across vendors
Microsoft is not alone in citing AI as a factor increasing the pace and volume of vulnerability discovery. The source notes that Adobe, Cisco, Google, Mozilla and Oracle have all recently credited AI-assisted research with raising patch cadence and volume. Google said it will now ship security updates every two weeks.
Those industry changes help explain why monthly bundles have grown so large: automated techniques and AI can surface more potential issues more quickly. But discovery is only the start of the operational problem for defenders.
What this means for enterprise Windows admins, security teams, and regular users
- Enterprise Windows administrators: Fortra’s Tyler Reguly emphasized the practical testing burden enterprises face. “It’s time to put our CISOs and CSOs on notice,” Reguly said, arguing that updates must be tested because third-party software does not always behave the same after OS changes. He suggested organizations may need to plan off-hours deployments and recognize the human cost of weekend or after-hours work to get patches deployed before Monday.
- Security teams and risk managers: Tenable’s Satnam Narang urged prioritization based on applicability and exploitability: “It’s critical that organizations understand which vulnerabilities actually apply to them, whether they pose a threat by being reachable and exploitable, and prioritize remediation based on this risk context.” Security teams will be watching per-patch breakdowns — the SANS Internet Storm Center provides a severity-ordered analysis — to decide which fixes must be rushed and which can be delayed for controlled testing.
- Regular Windows users: The reporting notes that individual Windows users do not need to perform enterprise-style testing; they must still open Windows Update periodically or accept prompts. Because the bundles are ballooning, the source cautions users not to let updates pile up month after month.
Administrators are also advised to monitor community reporting for any problematic updates; the story suggests askwoody.com as a place enterprise admins often watch for reports that patches are causing issues.
Microsoft’s September patch batch highlights a central tension now playing out across software security: faster discovery driven in part by AI is producing a much larger set of vulnerabilities to evaluate, but fixing them remains a human-intensive, operational task. With more than 2,600 patches already this year and three months remaining, defenders must balance the urgency of critical flaws—especially zero-days and high-scoring RCEs—against the practical need to test and deploy updates without disrupting business operations.
