Microsoft's September 2026 Patch Tuesday fixed 972 vulnerabilities, with 112 of them rated critical. That is a record. It is also the third consecutive record-breaking month: July patched 570, August patched 620. The trajectory is unmistakable. Microsoft is now fixing vulnerabilities faster than it ever has, and the pace shows no sign of slowing.
The Numbers in Context
Counting vulnerabilities in a Microsoft monthly release is never precise. Some bugs were previously addressed or affect non-Microsoft products. By Dustin Childs's count at the Zero Day Initiative, the September release patches 972 vulnerabilities, rising to 997 when including Chromium browser fixes ported into Edge. Of the new vulnerabilities, 112 carry the critical severity rating, meaning they could enable remote code execution or privilege escalation without user interaction.
Already in 2026, Microsoft has fixed 2,760 vulnerabilities. That is more than double the total from the same period last year. At the current rate, Microsoft will finish 2026 having patched more bugs than it did in all of 2023, 2024, and 2025 combined. The scale is extraordinary even by Microsoft's standards, and Microsoft has always patched more than anyone else.
Google and other major software vendors have published record vulnerability counts in recent months as well. The trend is industry-wide, not confined to one company's codebase.
AI-Assisted Discovery Is Driving the Spike
The connection between AI and vulnerability discovery is no longer speculative. Two weeks before the September patch release, OpenAI, Anthropic, Amazon Web Services, Google, Microsoft, and 100 other companies and organizations published an open letter warning of a narrowing window for patching vulnerabilities ahead of an expected wave of AI-enabled attacks. The letter framed the current moment as a race: AI tools are finding vulnerabilities faster than organizations can patch them.
The spike in published vulnerabilities reflects this acceleration. AI-assisted fuzzing, static analysis, and code review tools can scan large codebases more thoroughly and faster than human researchers working alone. The result is more bugs found, reported, and fixed. The pipeline from discovery to patch is compressing.
Childs at the Zero Day Initiative called the spike the "new normal" while noting an important caveat: the increase in discovered vulnerabilities has not yet produced a correlating spike in active exploits. The bugs are being found and patched before attackers can use them at scale. But that equilibrium depends on patching speed keeping pace with discovery speed, and the gap between the two is narrowing.
The Patching Window Is Shrinking
The open letter from the AI security coalition highlighted a specific concern: the time between vulnerability disclosure and active exploitation is decreasing. Historically, organizations had weeks or months to patch critical vulnerabilities before attackers developed reliable exploits. AI changes that timeline. An AI system can analyze a disclosed vulnerability, understand its trigger conditions, and generate a working exploit in hours rather than days.
For organizations running Microsoft infrastructure, this means the September patches are not optional. The 112 critical vulnerabilities include remote code execution flaws in Windows kernel components, Exchange Server, and Azure services. An attacker who develops an exploit for any of these before the patch is applied gains access to systems that millions of organizations depend on.
The volume of patches itself creates a secondary problem. IT teams cannot test and deploy 972 patches in a single maintenance window. Prioritization becomes critical: which patches address vulnerabilities that are likely to be exploited first? The critical-rated patches are obvious candidates, but the important-rated vulnerabilities may include bugs that AI-assisted exploit development can weaponize quickly.
What Organizations Should Do Now
The immediate action is clear: apply the September patches, prioritizing the 112 critical vulnerabilities. For organizations that cannot patch immediately, the Zero Day Initiative and CISA publish workarounds and mitigations for the most dangerous flaws. Network segmentation and zero-trust architectures limit the blast radius of any single vulnerability.
The longer-term challenge is operational. Organizations need to establish a patching cadence that can handle 1,000 or more vulnerabilities per month. This means automated testing pipelines, staged rollouts, and rollback procedures that do not require manual intervention for each patch. The old model of monthly maintenance windows with manual testing does not scale to this volume.
Monitoring for exploitation is equally important. Microsoft's Threat Intelligence Center and CISA's Known Exploited Vulnerabilities catalog track which vulnerabilities are being actively exploited in the wild. Organizations should correlate their patch status against these feeds. A vulnerability that is patched but not yet exploited is a different risk than one that is both unpatched and under active attack.
The September release is a record. It will not hold for long. The combination of AI-assisted discovery, expanding attack surfaces, and growing codebases means vulnerability counts will continue to rise. The question for every organization is whether their patching process can keep pace. Right now, for most, the answer is no.