Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days

Summary

Microsoft resolved a record 974 security vulnerabilities in its September Patch Tuesday release, including two zero-day flaws under active exploitation. The update addresses critical remote code execution and privilege escalation bugs across Windows, Office, and SQL Server products.

Key Takeaways

1. Microsoft on Tuesday broke Patch Tuesday records by addressing an earth-shattering 974 vulnerabilities spanning its software portfolio, including two flaws that it said have been actively exploited in the wild.
2. The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add both flaws to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by September 22, 2026.
3. According to TrendAI's Zero Day Initiative (ZDI), Microsoft has patched a total of 2,760 security flaws this year alone, indicating how artificial intelligence (AI)-assisted vulnerability discoveries are unlikely to slow down any time soon.

Statement Breakdown

• Claimed Facts: 75% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 5% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The reporting relies on direct disclosures from Microsoft, CISA mandates, and verified cybersecurity research firms. Specific CVE identifiers, CVSS metrics, and technical mechanisms are documented precisely. Minor sensationalism appears in opening descriptors, but core technical claims are accurate and cross-referenced.

Bias assessment: Technical Cybersecurity Reporting. The piece adopts an industry-oriented technical lens emphasizing enterprise exposure, patching burdens, and vulnerability research metrics. Coverage balances vendor accountability with perspectives from independent vulnerability researchers without ideological distortion.

Note: Contains verified vulnerability data and official vendor disclosures alongside researcher commentary.

Credibility flag: Verified Security Data

Claimed Facts (5)

• This states precise verifiable counts of vulnerabilities across Microsoft software categories.
• This is a factual calculation of the total security fixes issued in the update cycle.
• This provides historical monthly patch count figures from prior security bulletins.
• This is an official technical description from a vendor security bulletin.
• This cites specific historical telemetry data tracked by a security firm.

Opinions (5)

• This provides an expert assessment regarding operational remediation challenges.
• This represents an educated inference regarding the technical mechanism of a vendor patch.
• This characterizes the event as a historical turning point based on analyst perspective.
• This reflects an industry comparison based on an analyst's viewpoint.
• This is a value judgment arguing that high patch counts represent a net positive development.

Claims (5)

• The term earth-shattering is hyperbolic editorial framing.
• This asserts a direct causal link between AI tools and total patch counts without supplying empirical evidence.
• Claiming that vulnerability numbers have completely lost all meaning is an unprovable subjective assertion.
• Predicting that all long-standing vulnerabilities will eventually be fixed is an unsubstantiated forecast.
• This highlights the unverified nature of the exploitation scope due to a lack of disclosed data.

Key Sources

• Ravie Lakshmanan — Author, The Hacker News
• Microsoft — Software Vendor
• Jack Bicer — Director of Vulnerability Research at Action1
• Adam Barnett — Lead Software Engineer at Rapid7
• Satnam Narang — Senior Staff Research Engineer at Tenable
• Tyler Reguly — Associate Director of Security R&D at Fortra
• CISA — U.S. Federal Cybersecurity Agency
• Tenable — Cybersecurity Exposure Management Platform