Microsoft shipped almost as many security patches on Tuesday as it did in all of 2024. Two of them are being used against people right now.

The number everybody is quoting this week is wrong, and so is the next one, and so is the one after that. Not because anyone is being careless. Because there is no longer a single correct answer to the question “how many security holes did Microsoft fix on Tuesday.”

Here is what the serious counters published for September 8, 2026:

Source	Microsoft CVEs	Critical	What they are counting
Tenable	964	104	CVEs across affected Microsoft products, 860 rated Important, none Moderate or Low
BleepingComputer	966	105	Patch Tuesday itself, explicitly excluding 204 CVEs fixed earlier in September in Azure, Edge, Copilot Studio and other services
Zero Day Initiative	972	114	New Microsoft CVEs. ZDI puts the month at 997 once external and Chromium bugs are folded in
Talos	973	113	Total disclosed, of which 82 critical remote code execution
Qualys	974	113	Individual CVE identifiers across all Microsoft product families
The Register, Dark Reading	974	not stated	Total CVE deluge

Six competent organisations, six different totals, spread of ten. The gaps are all methodology: whether Chromium fixes that reach you through Edge belong to Microsoft, whether a cloud service CVE that Microsoft already fixed on its own servers counts as something you patched, whether a re-issued advisory is one CVE or two.

We are not going to pick a winner. We are going to make the opposite argument, which is that this is the first Patch Tuesday where the headline number carries almost no information, and treating it as a workload is the mistake that will actually hurt you.

What is not in dispute

Two vulnerabilities in this release are being exploited in the wild right now. Both were added to CISA’s Known Exploited Vulnerabilities catalog the same day, with a federal remediation deadline of September 22.

CVE-2026-81963, Windows Update Stack elevation of privilege, CVSS 7.8, rated Important. A link-following flaw that lets an authenticated local attacker reach SYSTEM, the highest privilege level on the machine. Tenable notes it is the first Windows Update Stack zero-day exploited in the wild since 2022. Credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Windows 11 and Windows Server 2025 are the affected platforms.

CVE-2026-85880, Windows Advanced Local Procedure Call elevation of privilege, CVSS 7.8, rated Important. A heap-based buffer overflow, same outcome, SYSTEM. Credited to Mark Kelly of Volexity and to David Galazin and Jeremy Hedges of Proofpoint. This one hits Windows 10 and the older Server releases, which matters more than it looks and we will come back to it.

Neither is a remote takeover on its own. Both are the second half of an attack. Somebody phishes a user or lands code through a document, gets a normal user account, and then uses one of these to become SYSTEM. The Zero Day Initiative’s read on CVE-2026-85880 is that it “can hide within documents and attachments, triggering when users interact with malicious content,” and on CVE-2026-81963 that it is the kind of bug “likely combined with code execution bugs to spread malware or ransomware.”

That is the standard ransomware shape. It is why an Important-rated 7.8 local privilege escalation deserves more of your attention this week than a Critical-rated 9.8 in a service you do not run.

Why the number exploded, in Microsoft’s own words

This is not a bad month. It is a new baseline, and Microsoft said so two months in advance.

Here is Microsoft’s own monthly count for 2026, using Tenable’s figures throughout so the methodology stays constant:

Month	Microsoft CVEs
January	113
February	54
March	83
April	163
May	118
June	198
July	569
August	398
September	964

January through June: 729 CVEs, an average of 122 a month. July through September: 1,931 CVEs, an average of 644 a month. The monthly average went up 5.3 times, and it did it in a single step in July.

For scale against history, Tenable’s year in review put Microsoft at 1,130 CVEs in all of 2025 and 1,009 in all of 2024, with a 2025 monthly average of 94. September 2026 alone is 95 percent of the entire 2024 calendar year and more than ten times a normal 2025 month. The first nine months of 2026 total 2,660, which is 2.35 times the whole of 2025 with a quarter still to run.

The cause is documented, and it is not a security crisis. On May 12, 2026, Microsoft published details of MDASH, its Multi-Model Agentic Scanning Harness: a pipeline that orchestrates more than a hundred specialised agents across an ensemble of frontier and distilled models, in a staged workflow that proposes candidate vulnerabilities, debates their exploitability across model families, and then builds proof-of-concept triggers to confirm the real ones. Microsoft reported 96 percent recall against five years of confirmed MSRC vulnerabilities in clfs.sys and 100 percent in tcpip.sys, and said the system had found 16 new flaws in the Windows networking and authentication stack, four of them critical remote code execution.

Then on July 9, 2026, on the Windows Experience Blog, Microsoft told customers what that would do to Patch Tuesday:

As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release. This is evidence that defenders are getting better at identifying and addressing issues.

July was the month the count went from 198 to 569. The warning and the jump are the same month. Whatever else is true, nobody can say this arrived unannounced.

We wrote last week about what AI-discovered vulnerabilities actually turn into, and this release is the largest single piece of evidence for the argument in that piece. Dustin Childs at the Zero Day Initiative put it plainly this week: AI-assisted vulnerability discovery shows no signs of slowing down, and “we have not seen a correlating spike in active exploits” yet.

The haystack arithmetic

Satnam Narang at Tenable gave the sharpest framing of the week:

AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn’t finding more needles. It’s critical that organizations understand which vulnerabilities actually apply to them, whether they pose a threat by being reachable and exploitable, and prioritize remediation based on this risk context.

We wanted to know how large the gap between haystack and needle actually is, so we measured it rather than assuming.

We downloaded CISA’s KEV catalog directly on September 9, 2026. Catalog version 2026.09.08, 1,699 entries, 215 of them added during 2026. Of those 215, 38 are Microsoft, and of those 38, 25 carry a 2026 CVE number. The other 13 are historical bugs from 2008 through 2025 that CISA back-filled this year as evidence of old exploitation surfaced.

So: Microsoft shipped roughly 2,660 CVEs in the first nine months of 2026. Twenty-five of them have confirmed in-the-wild exploitation in CISA’s catalog. That is 0.94 percent, or about one in every 106.

Two honest caveats, because the number is startling enough to be misused. First, this is not a settled score: a CVE published in September has had days to attract attackers, one published in January has had months, and some of the 2,660 will join KEV later. Second, KEV records what CISA has confirmed and chosen to publish, not everything that has ever been exploited anywhere. The true exploitation rate is higher than 0.94 percent.

Recounted September 10, 2026. We pulled the feed again a day later to see whether the arithmetic moved. Catalog version 2026.09.09, 1,703 entries, 219 added during 2026. Four new entries landed on September 9, and none of them is Microsoft: Citrix NetScaler (CVE-2026-19490), Fortinet (CVE-2025-25249) and Cisco Secure Firewall Management Center (CVE-2026-20079), all with a September 12 deadline, plus a second exploited Chrome V8 flaw (CVE-2026-87491) due September 23. The Microsoft figures below are therefore unchanged: still 38 Microsoft entries added in 2026, still 25 of them carrying a 2026 CVE number, still 0.94 percent. A day after the largest Patch Tuesday ever published, the exploited-Microsoft-bug count did not move at all, and the things that did move were three network edge appliances and a browser. That is the argument in this section, restated by the data rather than by us.

It is not remotely close to 100 percent, though, and that is the decision-relevant fact. If you treat a 964-CVE month as 964 units of work, you will either burn a month you do not have or, far more likely, freeze and do nothing. Both outcomes are worse than picking the right dozen.

The ones that would actually hurt a small business

Strip out everything that does not apply to a ten-person company in Toronto and the list gets short.

If you run any Windows Server on-premises, the DNS cluster is the headline. Tenable counted nine Windows DNS Server remote code execution flaws in this release. The one to look at is CVE-2026-69730, CVSS 9.8, Critical, rated “Exploitation More Likely” by Microsoft’s own index. It is a use-after-free that an unauthenticated remote attacker triggers with a crafted packet. No credentials, no clicking, no user involvement at all. The Zero Day Initiative called it the spiritual successor to SigRed, the 2020 wormable Windows DNS bug, and counted 20 wormable flaws in this release across DNS, DHCP, Active Directory, Message Queuing, RRAS and NFS. Affected platforms for CVE-2026-69730 run Windows Server 2012 through 2025, plus Windows 10 versions 1607 and 1809. Windows 11 is not on the list.

The reason this matters more than its severity score suggests: Microsoft installs DNS on every domain controller by default and recommends leaving it there. If you have a domain controller in a closet, the machine that answers name lookups and hands out authentication tickets is the machine with the 9.8 in it.

If you do not run Windows Server, most of the DNS story is not yours. A business on Microsoft 365 with laptops and no on-premises server has nothing to do here. That is not a loophole, it is the correct answer, and it is the single biggest reason the headline number is misleading.

Everybody has Office. Talos flagged five remote code execution flaws in Excel, two in Word including CVE-2026-78510 at CVSS 9.8, four in Outlook including CVE-2026-78509 at 9.8, and three use-after-free RCEs in PowerPoint at 8.8 each. These reach you the way Office bugs always have, through a document somebody sends you. They are fixed by the ordinary Microsoft 365 update channel, which for most small businesses means they are already fixed or will be within days without anyone doing anything.

The two zero-days apply to essentially every Windows machine you own. That is the work item.

The Windows 10 machines in your office just got a concrete reason to care

CVE-2026-85880, one of the two flaws being actively exploited this week, affects Windows 10.

Windows 10 reached end of support on October 14, 2025. The only way a Windows 10 machine receives this month’s fix is through the Extended Security Updates programme, and business and home machines are now on very different clocks. This is the part people get wrong, so it is worth being precise:

• Consumer ESU runs to October 12, 2027. Microsoft quietly added a second year in June 2026 and its own page now reads: “You can enroll in ESU any time until the program ends on October 12, 2027.” That is comfortable, and it is why most of the “Windows 10 dies next month” posts circulating this week are out of date.
• Commercial ESU is the one with a deadline. It is sold through Volume Licensing at $61 USD per device for Year One, and Microsoft’s documentation states the price doubles every consecutive year, to a maximum of three years, so $122 and then $244. Year One began in November 2025 and ends in October 2026. Critically, the programme is cumulative: a business that skips Year One and enrols in Year Two pays for both, which is $183 per device to buy a single year of patches. Devices must be on Windows 10 version 22H2, and the minimum purchase is one licence.

So a Windows 10 machine in your office is in one of four states this week. On consumer ESU: it gets the fix, and it is covered into late 2027. On commercial ESU Year One: it gets the fix, and you have about a month to decide about Year Two before the cumulative pricing bites. Not enrolled in anything: it does not get the fix for a vulnerability CISA has confirmed is being exploited right now, and it will not get the next one either. On Windows 11: fine, and it needs the other zero-day patch instead.

We went through all of the options, including the machines worth redeploying rather than paying to bridge, in leaving Windows 10 in the middle of a hardware shortage. The arithmetic there has not changed. What has changed is that the abstract argument now has a concrete, exploited-in-the-wild CVE attached to it, a few weeks before the commercial pricing steps up. If you have been putting this off, this is the month it stops being theoretical.

The part that should make you uncomfortable

Patching is necessary. It is not sufficient, and this week produced an unusually clean demonstration.

Within roughly two hours of the September updates going out, an anonymous researcher operating as Nightmare Eclipse published a working exploit called ShieldCrash. It is a bypass of ShieldBreak (CVE-2026-69414), a Microsoft Defender flaw that Microsoft patched in this very release. ShieldCrash grants SYSTEM on fully patched Windows 10, Windows 11 and all supported Windows Server versions, though without write access. Microsoft had not commented at the time of publication.

And ShieldBreak was itself a bypass of an earlier flaw called RoguePlanet, disclosed in June 2026 and patched in July 2026.

That is three rounds on the same underlying problem in four months, with the newest round starting the same afternoon the patch shipped. The lesson is not that patching is pointless. It is that “we applied the update” is a description of one control, not of a security posture, and anyone selling you a compliance dashboard that turns green on patch status is selling you a picture of one afternoon.

Adobe had a bigger week than usual too

Microsoft was not the only vendor shipping on Tuesday. Adobe published 10 bulletins covering 172 unique CVEs by the Zero Day Initiative’s count, or nine advisories and 170 vulnerabilities with 50 critical by Qualys’s. Again, both are right and the difference is bookkeeping.

One of them is the story we published two days ago. StyleSmuggler, the unauthenticated Magento and Adobe Commerce remote code execution chain that Sansec disclosed on September 5 while stores were being actively backdoored, now has a CVE, a CVSS score and a patch:

• CVE-2026-75650, CVSS 10.0.
• Adobe published APSB26-146 on September 7 at 20:20 UTC at priority 1, its highest.
• The fix ships as a hotfix rather than a full release: VULN-39341-composer-patches.zip from repo.magento.com, applied as a composer patch. Adobe tested it against the 2026-aug releases of Adobe Commerce 2.4.4 to 2.4.9, Magento Open Source 2.4.4 to 2.4.9, and Adobe Commerce B2B 1.3.3 to 1.5.3.
• CISA added it to KEV on September 8 with a federal deadline of September 11, a three-day window that is about as loud as CISA gets.

We wrote in that piece that the absence of a CVE meant this bug could not appear in KEV, and that every scanner, dashboard and insurance questionnaire keyed to CVE identifiers would report an actively compromised store as clean. That gap lasted about seventy-two hours. It closed, and the underlying point survives it: for those seventy-two hours the automation was blind, and the only thing covering the window was a human reading vendor-independent research. The full StyleSmuggler write-up is here, now updated with the patch procedure and the credential rotation Adobe requires.

Also in the same KEV batch, and worth thirty seconds if anyone else manages your computers: CVE-2026-86218, a CVSS 10.0 pre-authentication remote code execution flaw in N-able N-central, the remote monitoring platform thousands of IT providers use. It is the third distinct N-central flaw in about six weeks, it is confirmed exploited, and CISA gave it the same September 11 deadline. If you use a managed IT provider, that is a phone call, not a patch. We wrote up the questions to ask them when the previous N-central bug landed in August, and the list is unchanged.

Update, September 18, 2026: the other cost of a 974-CVE month, which is what the patch breaks

Everything above is about what the September update fixed. Ten days on, Microsoft’s own release health page has a second story, and for a small business it is the more likely one to actually bite. We read the Windows 11 25H2 known issues page directly this morning rather than the coverage. Four issues are open or recently closed against KB5124008, the September 8 update, and its 26H1 sibling KB5124012:

Issue	Status	Fixed by
Remote Desktop Services becomes unstable, RDP connections fail after several minutes, servers hang at “Please wait for the Remote Desktop Configuration”	Resolved	Out-of-band KB5129195, September 14
Plan9 host folder shares unavailable in Hyper-V Linux VMs, affecting WSL among others	Resolved	Out-of-band KB5129195, September 14
USB Audio Class 1.0 devices fail to start or produce no sound	Partially resolved	KB5129195 fixes the multichannel symptoms only
Domain-joined devices lose their secure trust relationship with the domain	Mitigated, opened September 16	No fix yet

The last one is the one to know about if you have an office with a Windows domain. In Microsoft’s words, after installing KB5124008 or later, some Credential Guard protected machine accounts “might lose their secure channel with an on-premises Active Directory (AD) domain,” and users “might then be unable to sign in interactively with valid domain credentials and might receive a message stating that the trust relationship between the device and the domain failed.” Offline sign-in with cached credentials may still work, and the domain controllers themselves are not affected.

The cause is specific enough to be worth stating, because it tells you whether you are at risk. The update does not switch on Machine Identity Isolation. It causes Windows to start honouring the setting if something already enabled it. That feature is only supported against domain controllers at Windows Server 2025 Domain Functional Level or above, so the machines that break are ones that had it configured, by Intune, by group policy or directly in the registry, while running against older domain controllers. Microsoft’s workaround is to disable it the same way it was enabled, and for the registry case:

On the Windows 11, version 24H2 or 25H2 device, locate the following registry paths: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation, HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation. For either of these registry keys, if the value for MachineIdentityIsolation = 2, then set MachineIdentityIsolation = 0.

Restart, then repair the channel with Test-ComputerSecureChannel -Repair -Credential (Get-Credential). Microsoft says it plans to resolve this in a future update by temporarily preventing enforcement while the feature is improved.

Two things worth taking from that, and neither of them is “delay patching.” The two exploited zero-days in this release are real and the fix for them is this update.

First, step 1 below is now two steps. Confirm the September update installed, and then confirm the September 14 out-of-band KB5129195 installed on top of it, because that is where the Remote Desktop and Hyper-V fixes live. A machine that took KB5124008 and stopped is patched against the zero-days and still carries two known regressions.

Second, this is the part of a record Patch Tuesday that the CVE count never shows. Nine hundred and seventy-four fixes is a number about attackers. Four regressions, one of them locking users out of their own domain-joined laptops, is a number about you, and it is the one that generates the support calls. The honest planning assumption for a month this size is not that patching is risky, it is that the first fortnight after a large update now reliably contains an out-of-band release, and your patching window should have room for it.

Do this, in order

1. Confirm your Windows machines got Tuesday’s update. Settings, Windows Update, check for updates. For most small businesses running Windows 11 Pro with default settings, this has already happened. Verifying takes a minute per machine and is the entire response to the only two Microsoft CVEs currently known to be under attack.

2. Find your Windows 10 machines and confirm each one is actually enrolled in ESU. One of this week’s exploited flaws is a Windows 10 flaw, and an unenrolled Windows 10 machine did not receive the fix. Consumer ESU is covered to October 2027, so a home or personal-ish machine is fine if it is enrolled. Commercial Year One ends in October 2026 and the pricing is cumulative, so business machines need a decision this month: continue, replace, or redeploy. All three are legitimate. Not choosing is not.

3. If you have an on-premises Windows Server, patch it before you patch anything else. Especially a domain controller, because DNS is on it by default and CVE-2026-69730 is an unauthenticated remote code execution rated more likely to be exploited. If you cannot patch it this week, at minimum confirm that port 53 is not reachable from the internet.

4. If you use a managed IT provider, ask them two questions today. Which N-central version are you on, and have you reviewed our environment for indicators of compromise. watchTowr’s line on this one is worth repeating verbatim: “Patching alone is not enough.” An RMM server holds privileged credentials for every machine in every client network it manages, so a compromise that predates the patch survives the patch.

5. If you run a Magento or Adobe Commerce store, you are already late. Apply the APSB26-146 hotfix, then rotate the encryption key and every credential it protected: admin passwords, REST, SOAP and GraphQL integration tokens, OAuth client secrets, payment gateway credentials, database credentials, SSH and deploy keys, third-party extension keys. The patch stops the next attacker. It does nothing about whatever the last one took.

6. Stop reporting patch counts to anybody. If your monthly IT report has a line that says “966 vulnerabilities addressed,” delete it. It measured something real in 2024 and it measures nothing now. Replace it with three lines: are there KEV-listed vulnerabilities in anything we run, is anything we run reachable from the internet that should not be, and what is our oldest unpatched machine.

7. Write down which Microsoft products you actually run. This sounds trivial and it is the single highest-leverage thing on this list. In a 964-CVE month, the difference between an afternoon of work and a month of panic is entirely a question of whether you can say “we do not run Exchange, SharePoint, SQL Server or Windows DNS” without checking. Most small businesses cannot, and that is the actual finding.

What we would tell a client this week

Nothing about this release changes what a well-run small business should do. It changes what a badly-run one can get away with pretending.

For years, “we patch monthly” was a defensible position partly because the volume was small enough that patching everything and prioritising nothing produced the same result. At 94 CVEs a month you can apply all of them. At 644 a month you cannot, and the gap between organisations that prioritise by exposure and organisations that work down a list will widen every month from here. Microsoft’s own guidance in July said the same thing in gentler language: build a risk map of your estate, prioritise protections for high-value targets, and accelerate deployment where exposure is greatest.

The best free version of that discipline is still the one we wrote about in August, CISA’s risk-based patching directive. It is written for federal agencies and it copies cleanly onto a fifteen-person company: know what you have, know what is exposed, fix what is being exploited first, and hold yourself to a deadline. Applied to this week, that whole 964-item release resolves into four things for most of our clients, and two of them are “check that automatic updates ran.”

The other thing worth carrying forward is a piece of good news that reads like bad news. A record patch count driven by AI-assisted discovery is defenders finding bugs before attackers do. Twenty-five confirmed exploited out of 2,660 is not a failure of the scanning, it is the scanning working: Microsoft is now fixing large numbers of flaws that nobody was ever going to weaponise, which is exactly what you want and exactly what makes the monthly number useless as a threat signal.

The risk is not the bugs. The risk is that the volume makes the signal harder to find, and that a business with no security team looks at 964, decides the whole category is hopeless, and stops opening the email. If that is where your organisation is heading, the fix is not more effort. It is a shorter list.

If you would like us to work out what that shorter list is for your business, which Microsoft products you actually run, what is exposed, and what is genuinely urgent this month, send us a note. It is a short review and it usually ends with a list of four things rather than nine hundred.

Sources

• Windows 11, version 25H2 known issues and notifications, Microsoft Learn, read directly on September 18, 2026 for the September 18 update above, for the four known issues against KB5124008 and their statuses, the September 14 out-of-band release KB5129195 and which symptoms it resolves, the quoted description of the domain secure channel failure, the Machine Identity Isolation cause and the Windows Server 2025 Domain Functional Level precondition, the quoted registry workaround and the Test-ComputerSecureChannel -Repair command, and Microsoft’s stated plan to prevent enforcement in a future update
• Microsoft’s September 2026 Patch Tuesday Addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880), Tenable, September 8, 2026, retrieved September 9, 2026, for the 964 total, the 104 critical and 860 important split, the 44.7 percent EoP and 26.8 percent RCE distribution, the CVSS 7.8 ratings and technical detail on both zero-days, the note that CVE-2026-81963 is the first exploited Windows Update Stack zero-day since 2022 and that CVE-2026-85880 is the first ALPC flaw in a Patch Tuesday since April 2023, and the nine Windows DNS Server RCEs including CVE-2026-69730 at CVSS 9.8
• Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days, BleepingComputer, September 8, 2026, retrieved September 9, 2026, for the 966 count and its explicit exclusion of 204 CVEs fixed earlier in September, the 105 critical breakdown, the category totals, the credits to Romain Deperne, MSTIC, Volexity and Proofpoint, and the attribution of the volume increase to Microsoft’s AI-powered vulnerability discovery
• The September 2026 Security Update Review, Zero Day Initiative, September 8, 2026, retrieved September 9, 2026, for the 972 new Microsoft CVEs and 997 including external and Chromium bugs, the 114 critical count, the 20 wormable flaws across DNS, DHCP, Active Directory, Message Queuing, RRAS and NFS, the “SigRed’s spiritual successor” characterisation of CVE-2026-69730, the 10 Adobe bulletins covering 172 CVEs, and Dustin Childs on AI-assisted discovery and the absence so far of a matching spike in active exploits
• Microsoft Patch Tuesday for September 2026, Snort rules and prominent vulnerabilities, Cisco Talos, September 2026, retrieved September 9, 2026, for the 973 total with 113 critical and 82 critical RCEs, and the Office breakdown covering five Excel RCEs, two Word RCEs including CVE-2026-78510, four Outlook RCEs including CVE-2026-78509, and three PowerPoint use-after-free RCEs
• Microsoft and Adobe Patch Tuesday, September 2026 Security Update Review, Qualys, September 8, 2026, retrieved September 9, 2026, for the 974 count with 113 critical and 860 important, the September 22 CISA deadline on both zero-days, and the nine Adobe advisories covering 170 vulnerabilities with 50 critical
• Microsoft breaks Patch Tuesday record with 974-CVE deluge, The Register, September 9, 2026, and Patch Tuesday Sets Another Record With 974 CVEs, Dark Reading, September 2026, both retrieved September 9, 2026, for the 974 figure
• September 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor, Help Net Security, September 9, 2026, retrieved September 9, 2026, for the affected-platform split between the two zero-days, the 20 wormable bugs, and the Satnam Narang quote on larger haystacks quoted in full above
• Known Exploited Vulnerabilities Catalog JSON feed, CISA, catalog version 2026.09.08, downloaded and counted directly on September 9, 2026, for the 1,699 total entries, the 215 added during 2026, the 38 Microsoft entries added in 2026 of which 25 carry 2026 CVE numbers, and the dateAdded and dueDate values for CVE-2026-81963, CVE-2026-85880, CVE-2026-75650 and CVE-2026-86218. Re-downloaded September 10, 2026 at catalog version 2026.09.09 for the recount above: 1,703 total entries, 219 added during 2026, Microsoft figures unchanged at 38 and 25, and the four September 9 additions with their due dates
• CISA Adds Four Known Exploited Vulnerabilities to Catalog, CISA, September 8, 2026, retrieved September 9, 2026, for the four entries and CISA’s own vulnerability names
• Evolving Windows vulnerability management to meet the speed of AI-powered discovery, Windows Experience Blog, July 9, 2026, retrieved September 9, 2026, for the quoted warning that customers will see a higher volume of security updates, the description of MDASH and its scanner and prove pipelines, the Secure Development Lifecycle update, and the guidance to build a risk map and prioritise by exposure
• Defense at AI speed: Microsoft’s new multi-model agentic security system tops leading industry benchmark, Microsoft Security Blog, May 12, 2026, retrieved September 9, 2026, for the MDASH architecture of more than 100 specialised agents across frontier and distilled models, the 96 percent recall in clfs.sys and 100 percent in tcpip.sys, and the 16 new Windows networking and authentication vulnerabilities including four critical RCEs
• Microsoft Patch Tuesday 2025 Year in Review, Tenable, December 2025, retrieved September 9, 2026, for the 1,130 CVEs in 2025, the 1,009 in 2024, the 12 percent year-over-year increase, the 94 per month average, and the 41 zero-days of which 24 were exploited in the wild
• Tenable’s monthly Patch Tuesday analyses for January, February, March, April, May, June, July and August 2026, all retrieved September 9, 2026, for the monthly series of 113, 54, 83, 163, 118, 198, 569 and 398 used in the table above. Using one analyst’s counts throughout keeps the methodology constant across the series
• New Microsoft Defender ‘ShieldCrash’ zero-day grants SYSTEM access, BleepingComputer, September 9, 2026, retrieved September 9, 2026, for ShieldCrash as a bypass of ShieldBreak (CVE-2026-69414) patched in this release, the lineage back to RoguePlanet disclosed in June and patched in July 2026, the affected Windows 10, 11 and Server versions, the SYSTEM-without-write-access outcome, and the absence of Microsoft comment at publication
• Extended Security Updates (ESU) program for Windows 10, Microsoft Learn, retrieved September 9, 2026, for the October 14, 2025 end of support date, the $61 USD per device Year One commercial price, the statement that the price doubles every consecutive year to a maximum of three years, the Windows 10 22H2 prerequisite, the one-licence minimum, the cumulative purchase rule and the November 2025 Year One start
• Windows 10 Consumer Extended Security Updates (ESU) program, Microsoft, retrieved and read directly on September 9, 2026, for the consumer programme end date, quoted verbatim above as October 12, 2027. A great deal of secondary coverage still cites October 13, 2026, which was correct until Microsoft added a second consumer year in June 2026 without announcing it. Microsoft’s own page is the authority here and it is the one we used
• Urgent Action Required: Critical Security Update Available for Adobe Commerce (APSB26-146), Adobe, September 7, 2026, retrieved September 9, 2026, for the priority 1 rating, the VULN-39341 composer hotfix, the tested version ranges across Adobe Commerce, Magento Open Source and Adobe Commerce B2B, and the credential rotation requirement
• StyleSmuggler (CVE-2026-75650): Frequently Asked Questions about Adobe Commerce and Magento zero-day, Tenable, September 8, 2026, retrieved September 9, 2026, for the CVSS 10.0 score, the September 4 exploitation and September 5 disclosure timeline, and the September 7 patch date. This FAQ states the CVE had not been added to KEV as of its publication; CISA added it later the same day, which the KEV feed above confirms
• N-able N-central Pre-Auth RCE Flaw Exploited in the Wild, The Hacker News, September 2026, retrieved September 9, 2026, for CVE-2026-86218 at CVSS 10.0, the N-central 2026.3 Hotfix 4 fix, the companion authentication bypass pair CVE-2026-86206 and CVE-2026-86207, the confirmation of in-the-wild exploitation, the September 11 federal deadline and the watchTowr statement that patching alone is not enough