Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days

Summary

Microsoft's September Patch Tuesday addressed a record 974 vulnerabilities, including two actively exploited zero-days. The patches cover critical flaws across Windows, Office, and SQL, with over 110 rated critical. Experts emphasize the challenge of prioritizing such a large volume of updates.

Key Takeaways

1. Microsoft addressed a record 974 vulnerabilities in its September Patch Tuesday, including two actively exploited zero-days.
2. The vulnerabilities patched include 723 in Windows, 111 in Office and Office 2016, 62 in SQL, and 22 in Developer Tools, with over 110 assigned a critical severity rating.
3. Two vulnerabilities, CVE-2026-85880 and CVE-2026-81963, have been actively exploited in the wild, allowing for privilege escalation.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article relies on official advisories and expert commentary, providing specific CVE details and CVSS scores. While it reports on exploited vulnerabilities, it acknowledges Microsoft's lack of specifics on attack scale and victims, maintaining a balanced approach.

Bias assessment: Security-Focused Tech Reporting. The article's primary focus is on technical security vulnerabilities and their patching. It adopts a neutral tone, presenting facts about software flaws and expert opinions on managing them, without leaning towards a particular political or social agenda.

Note: This article details technical security vulnerabilities and their fixes. Readers should consult official Microsoft advisories for direct technical guidance and consider the implications for their specific systems.

Credibility flag: Technical Security Focus

Claimed Facts (7)

• This is a direct statement of fact regarding the number of vulnerabilities patched and the exploitation status.
• This provides specific numbers for vulnerabilities across different Microsoft products.
• This quantifies the severity of the patched vulnerabilities.
• This categorizes the types of vulnerabilities addressed.
• This provides specific details about one of the exploited vulnerabilities, including its CVE ID and technical description.
• This provides specific details about the second exploited vulnerability, including its CVE ID and technical description.
• This states a factual action taken by a government agency regarding the vulnerabilities.

Opinions (5)

• This is a subjective statement from an expert about the operational challenge posed by the large number of patches.
• This is an expert's opinion on the necessary actions for IT and security teams.
• The word 'presumably' indicates an inference or opinion about the effect of the patch, rather than a confirmed outcome.
• This is a subjective assessment by an expert on the significance of the large patch numbers.
• This statement offers a broader perspective and an optimistic outlook on the long-term implications of current patching practices.

Claims (5)

• The term 'earth-shattering' is hyperbolic and emotional language, not a factual descriptor of the vulnerabilities themselves.
• While this is a quote from Microsoft, the claim of an attacker's capability is a hypothetical scenario presented without evidence of actual exploitation in this specific context.
• This statement, while potentially true for the vulnerability, is presented without specific evidence within the article and could be a generalization.
• The claim of 'zero-day exploitation efforts' is stated without any supporting evidence or details, making it a potentially unsubstantiated assertion.
• The assertion that AI-assisted discoveries are 'unlikely to slow down' is a prediction and an interpretation, not a directly verifiable fact presented in the article.

Key Sources

• Jack Bicer — Director of Vulnerability Research at Action1
• Action1 — Cybersecurity Company
• Adam Barnett — Lead Software Engineer at Rapid7
• Rapid7 — Cybersecurity Company
• Microsoft — Technology Company
• Volexity — Cybersecurity Company
• Proofpoint — Cybersecurity Company
• Romain Deperne — Offensive Security Researcher at Airbus Helicopters
• Airbus Helicopters — Aerospace Company
• Microsoft Threat Intelligence Center (MSTIC) — Microsoft Security Division
• Tenable — Cybersecurity Company
• U.S. Cybersecurity and Infrastructure Security Agency (CISA) — U.S. Government Agency
• TrendAI's Zero Day Initiative (ZDI) — Vulnerability Research Program
• Satnam Narang — Senior Staff Research Engineer at Tenable
• Tyler Reguly — Associate Director of Security R&D at Fortra
• Fortra — Cybersecurity Company