Why this month's Microsoft patch release is a doozy

Ars Technica

Ars Technica2026年9月8日

Why this month's Microsoft patch release is a doozy

5.0内容质量

TL;DR · AI 摘要

文章内容为网站隐私政策与Cookie设置说明，非技术性内容，缺乏工程实践价值。

核心要点

文章非技术内容，无工程实践指导
未涉及技术原理或架构设计
信息密度极低，不适合作为技术阅读材料

思维导图

用一张图看清主题之间的关系。

查看大纲文本（无障碍 / 无 JS 友好）

隐私政策与Cookie设置

#隐私政策#Cookie

打开原文

Why this month's Microsoft patch release is a doozy - Ars Technica

Privacy Center

Currently, only residents from GDPR countries and certain US states can opt out of Tracking Technologies through our Consent Management Platform. Additional options regarding these technologies may be available on your device, browser, or through industry options like AdChoices. Please see our Privacy Policy for more information.

Social Media

[x] On

These cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

* *

Essential

[x] On

This website uses essential cookies and services to enable core website features and provide a seamless user experience. These cookies and services are used to facilitate features such as navigation, remember user preferences, and ensure the security of the website.

* *

Targeted

[x] On

These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

* *

Performance

[x] On

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.

* *

Functional

[x] On

This website uses functional cookies and services to remember your preferences and choices, such as language preferences, font sizes, region selections, and customized layouts. They enable this website to offer enhanced and personalized functionalities.

* *

Audience Measurement

[x] On

We use audience measurement cookies in order to carry out aggregated traffic measurement and generate performance statistics essential for the proper functioning of the site and the provision of its content (for example to measure performance, to detect navigation problems, to optimization technical performance or ergonomics, to estimate server power needed and to analyse content performance). The use of these cookies is strictly limited to measuring the site's audience. These cookies do not allow the tracking of navigation on other websites and the data collected is not combined or shared with third parties. You can refuse the use of this cookie by switching off the slider to the right.

OK

English Deutsch Español Français Italiano 日本語繁體中文

en

Privacy Policy

Consent powered by Ethyca

Skip to content Ars Technica home

Sections

Forum Subscribe Search

Forum Subscribe

Story text

Size Width * Links

Subscribers only

Learn more

Pin to story

Theme

HyperLight
Day & Night
Dark
System

[Search](https://arstechnica.com/search/ "Search")

Sign In

Sign in dialog...

Sign in

LLM-DRIVEN BUG DISCOVERY

Why this month’s Microsoft patch release is a doozy

Security gnomes are pumping out patches ahead of an expected onslaught of AI-assisted attacks.

Dan Goodin – Sep 8, 2026 9:11 PM|[94](https://arstechnica.com/security/2026/09/microsoft-patches-a-record-972-vulnerabilities-112-of-them-critical/#comments "94 comments")

![Image 1](https://cdn.arstechnica.net/wp-content/uploads/2023/07/exploit-vulnerability-security.jpg)

Credit: Getty Images

Text settings

Story text

Size Width * Links

Subscribers only

Learn more

Minimize to nav

Microsoft’s patch for September is a doozy, with a record number of roughly 972 vulnerabilities fixed and 112 of them meeting the high critical-severity threshold.

It was only two months ago that Microsoft patched a then-record 570 vulnerabilities. Then, last month, Microsoft patched some 620 of them. Google and other companies have also published record numbers of vulnerabilities in recent months. Two weeks ago, OpenAI, Anthropic, Amazon Web Services, Google, Microsoft, and 100 companies and organizations published an open letter warning of a narrowing window for patching vulnerabilities ahead of an expected tsunami of AI-enabled attacks that actively exploit them first. The industry is taking the threat seriously by pumping out unprecedented numbers of patches in their software.

Welcome to the new normal

Dustin Childs, a researcher at the Zero Day Initiative, calls the spikes the “new normal” and also cautions that despite them, the damage that’s likely to result from AI-assisted attacks could eventually be substantial.

“On the one hand, congrats to the security gnomes at Microsoft for being able to patch bugs at this rate,” Childs wrote Tuesday. “On the other hand, AI-assisted vulnerability discovery shows no signs of slowing down. However, we have not seen a correlating spike in active exploits—yet.”

Ars Video

[](https://arstechnica.com/security/2026/09/microsoft-patches-a-record-972-vulnerabilities-112-of-them-critical/)

Counting the precise number of vulnerabilities fixed in a monthly patch release for Microsoft is never an exact science. In some cases, the bugs were previously addressed or affected non-Microsoft products. By Childs’ count, Tuesday’s release patches 972 vulnerabilities, and 997 when counting the porting of fixes for the Chromium browser incorporated into Edge. Of the new vulnerabilities, 112 of them are rated critical, with the remainder carrying the important designation. Already this year, Microsoft has fixed 2,760 vulnerabilities, more than double the number from last year. At this rate, Microsoft will complete the year having fixed more bugs than all of 2023, 2024, and 2025 combined.

Credit: Microsoft

Notable vulnerabilities in this month’s release include two zero-days, CVE-2026-81963 and CVE-2026-85880, in the Windows update service and the Windows Advanced Local Procedure, respectively. There’s no public information about who is exploiting them or how broadly. Other notable vulnerabilities Childs called out are:

CVE-2026-55007 in Exchange Server. A remote, unauthenticated attacker could get code execution on an affected Exchange server by doing nothing more than sending an email with a malicious Visio attachment.
CVE-2026-80097: A local privilege escalation in Microsoft Authenticator. “This is the worst type of privilege escalation as it uses a bug in the authentication system itself,” Childs said.
CVE-2026-69465:Roughly 17 distinct vulnerabilities in Microsoft Office SharePoint allowing remote code execution.
CVE-2026-65669: One of 60 SQL Server privilege escalation vulnerabilities this month. This particular one is exploited when a user submits instructions through SQL Copilot.
CVE-2026-69525:A remote code execution flaw in Remote Desktop Services with a 9.8 severity rating.

The researcher said he found so many of Tuesday’s vulnerabilities that were wormable that he stopped counting at 20. These vulnerabilities don’t require any user interaction to be exploited and hence can spread from machine to machine on their own, triggering a possible chain reaction that’s difficult to stop.

The effectiveness of AI-assisted vulnerability hunting is filled with controversy. Critics question the expense and number of false positives when using LLMs. They also question the motives of companies trying to recoup the billions of dollars they’re pouring into developing the very AI engines being used to find and patch the flaws.

The counterargument is that the results—AI-assisted hunting finding record numbers of severe bugs across the industry—speak for themselves. Mozilla, for instance, said in May that its researchers, using Mythos, found a record 271 vulnerabilities, with almost none of them being false positives.

The true, long-term effectiveness of AI-assisted bug hunting won’t be known for a time but will likely be measured in a year or more. What’s clear now is that critics should maintain curiosity and remain open to the possibility that vulnerability discovery has entered a new and unprecedented phase. Skeptics who discount the possibility do so at their own peril.

Dan GoodinSenior Security Editor

Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at here on Mastodon and here on Bluesky. Contact him on Signal at DanArs.82.

[94 Comments](https://arstechnica.com/security/2026/09/microsoft-patches-a-record-972-vulnerabilities-112-of-them-critical/#comments "94 comments")

Comments

Forum view

Loading comments...

[Prev story](https://arstechnica.com/space/2026/09/astronaut-on-iss-celebrates-60-years-of-star-trek-with-prop-badge/ "Go to: The universal language of space is... Star Trek? Mais oui.")

[Next story](https://arstechnica.com/gaming/2026/09/gog-brings-back-big-box-pc-games-one-printable-template-at-a-time/ "Go to: GOG brings back \"big box\" PC games, one printable template at a time")