“Patch 974 vulnerabilities” is not an executable change plan. It is a count.

Microsoft’s September 2026 Security Update Guide says the release contains 974 Microsoft CVEs, plus 25 republished non-Microsoft CVEs. Two Windows privilege-escalation flaws are already in CISA’s Known Exploited Vulnerabilities catalog. Those two belong at the front of the queue; the rest need exposure and business context.

TL;DR

  • Microsoft’s own release notes list 974 Microsoft CVEs. Contemporary third-party totals differ because counting methods and data snapshots differ.
  • CVE-2026-81963 and CVE-2026-85880 are exploited Windows local privilege-escalation vulnerabilities. CISA added both on September 8 with a September 22 federal remediation deadline.
  • “Local” does not mean low priority: an attacker can use privilege escalation after phishing, a stolen session, or another initial foothold.
  • Microsoft has acknowledged Remote Desktop Services instability after the September update across multiple Windows client and server versions.
  • Use emergency and canary rings, out-of-band access, measurable deployment evidence, and exception deadlines. Do not choose between patching blindly and waiting indefinitely.

What 974 Actually Means

The number comes from Microsoft’s machine-readable September release notes, whose September 11 revision states that the release consists of 974 Microsoft CVEs. The same document groups affected products across Windows, Office, Exchange Server, SharePoint Server, SQL, Azure, developer tools, Skype for Business, and other products.

It is inaccurate to call all 974 “Windows holes.” It is also risky to convert the total into 974 separate endpoint projects. Microsoft updates are frequently cumulative, and one deployed product update can address many CVEs.

Early public counts ranged from 972 to 974, while the number of critical issues also varied. That is normal when analysts include different product families, republished third-party CVEs, and revisions. Use the vendor’s current data for inventory matching; use independent analysis to understand operational impact.

The Two Known-Exploited Vulnerabilities

CVE-2026-81963: Windows Update Stack

Microsoft describes CVE-2026-81963 as improper link resolution before file access in the Windows Update Stack. An authorized local attacker can elevate privileges. CISA’s KEV entry says successful exploitation can reach SYSTEM.

CVE-2026-85880: Windows ALPC

CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC). Microsoft and CISA describe it as a local privilege-escalation vulnerability under active exploitation.

Neither flaw is a drive-by internet RCE. Both matter because real intrusions are chains. A phished user, malicious document, browser compromise, stolen remote session, or low-privileged service identity becomes much more dangerous when it can cross to SYSTEM.

Microsoft has not publicly described the observed exploitation in enough detail to justify naming a threat actor, initial-access vector, or malware family. “Exploitation detected” is the confirmed boundary.

The Patch Has an Operational Risk Too

On September 11, Microsoft acknowledged that the September security update can make Remote Desktop Services unstable in some environments. Symptoms include RDP failures after several minutes, sign-in problems, servers hanging at “Please wait for the Remote Desktop Configuration,” and related tools becoming unresponsive.

The affected-platform list spans Windows 11 and Windows 10 releases and Windows Server 2012 through 2025. As of September 12, Microsoft marked the issue as mitigated, not resolved, and said it was working on a future update. Its documented temporary recovery for an inaccessible virtual machine was to stop, deallocate, and restart it. Administrators should recheck Windows release health before each deployment wave because that status can change.

That regression changes deployment engineering, not the exploitation facts. Systems with RDS need a smaller canary ring, console or hypervisor access, a tested recovery path, and close health monitoring. They do not need an open-ended exemption with no owner.

Turn the Release into a Queue

PriorityOwner and actionVerification
1 — Known exploitationEndpoint and server teams deploy fixes covering CVE-2026-81963 and CVE-2026-85880 to affected assets. Prioritize privileged workstations, jump hosts, servers with interactive users, and endpoints with recent suspicious activity.Query the running OS build or update state after restart. Scanner status alone is insufficient if the machine has not completed installation.
2 — Reachable critical pathsProduct owners map the remaining CVEs to installed roles and exposed services, especially unauthenticated network-facing components and systems protecting identity or administration.Each urgent CVE has an affected asset list, exposure evidence, owner, deadline, and tested update—not only a severity score.
3 — RDS canariesEUC and server teams deploy first to representative RDS hosts with out-of-band access. Monitor connection success, logon time, session stability, MMC, File Explorer, and Windows Update behavior.A synthetic RDP session connects, remains stable, signs out, and reconnects. Recovery has been rehearsed without relying on RDP.
4 — Broad ringsRoll through representative hardware, business applications, regional sites, and finally the remaining fleet. Keep rings short enough that known exploitation cannot wait behind a week of generic testing.Compliance is measured by successful install, required restart, current build, and service health. Failed and offline devices create tickets automatically.
5 — ExceptionsCompensate for blocked systems with access reduction, application control, EDR coverage, removal of interactive use, and a dated remediation decision.Every exception names the incompatible dependency, approving owner, compensating controls, expiry, and replacement or fix plan.

For home users, the plan is simpler: install Windows and Microsoft application updates, restart when prompted, confirm Windows Update reports current status, and keep a current backup. Do not use third-party “driver updater” or patch sites to solve a Microsoft update warning.

For enterprises, count exposure hours, not just CVEs. A vulnerable build actively running on an administrator workstation is a different risk from an uninstalled component in a gold image, even if both appear in the same monthly spreadsheet.

The record Patch Tuesday is a capacity warning. The defensive response is not to treat 974 items equally. It is to know which flaws are exploited, which affected components are present and reachable, whether the fix is actually running, and how quickly a bad update can be contained without abandoning the security update.

Sources