Microsoft's Record 974-CVE Patch Tuesday: What UK Businesses Must Fix First

On 9 September 2026, Microsoft shipped the largest Patch Tuesday in the programme’s history. The September release addresses 974 CVEs across Microsoft’s own products - a record, and a number large enough that it changes the shape of the job rather than just its size. Two of those vulnerabilities are already being exploited in the wild as zero-days. Nine of them sit in Exchange Server, and one of those nine can be triggered by an attacker who does nothing more than send an email. Adobe, releasing on the same day, added 172 CVEs of its own across ten bulletins, including a maximum-severity flaw in Magento and Adobe Commerce that has been under active attack since 4 September.

For a UK business reading this on the morning of 9 September, the practical question is not “how many patches are there” but “which ones cannot wait until the weekend”. A 974-CVE release cannot be consumed as a single undifferentiated update wave. It has to be triaged. The good news is that the triage is unusually clear this month: the US Cybersecurity and Infrastructure Security Agency has already added three of these vulnerabilities to its Known Exploited Vulnerabilities catalogue and attached deadlines to them - 11 September for the Adobe Commerce flaw and 22 September for the two Microsoft zero-days. Those dates bind US federal agencies, not British companies, but they are the most reliable free prioritisation signal any UK SME will get, and they are published before most vendors’ own risk ratings have filtered through to a helpdesk queue.

The bad news is that the exposure does not stop at the vendors’ own bulletins. Google patched a Chrome zero-day in the V8 JavaScript engine on 3 September, tracked as CVE-2026-85046. That engine is the same one underneath Microsoft Edge, so the exposure crosses into the browser most UK businesses standardised on when they moved to Microsoft 365 - but Microsoft has not yet published its own security advisory for it. Any organisation whose patching process is driven purely by vendor advisories will therefore not see this one at all. It is the clearest illustration this month of why a patch programme built on a single vendor’s feed is a patch programme with holes in it.

What Microsoft actually shipped on 9 September

The headline figure of 974 CVEs covers vulnerabilities in Microsoft’s own products. It is a record for a single Patch Tuesday, and the scale itself is worth pausing on, because it tells you something about how vulnerability disclosure has changed. Patch Tuesday releases in the low hundreds were once considered heavy. A release approaching a thousand is not a sign that Microsoft’s code got four times worse in a year; it reflects a much larger surface being scanned by a much larger population of researchers, automated discovery tooling that finds variants of a known bug class in bulk, and a cloud-era product catalogue in which a great many components now carry their own CVE identifiers. The consequence for an IT team is the same either way. The signal-to-noise ratio of a Patch Tuesday summary has collapsed, and reading the full list is no longer a realistic Tuesday-afternoon activity for a business without a dedicated security function.

Within that volume, two vulnerabilities are categorically different from the other 972, because attackers were already using them before the patch existed. CVE-2026-85880 is a privilege escalation flaw in the Windows Advanced Local Procedure Call subsystem - ALPC, the internal messaging plumbing that Windows components use to talk to one another. The flaw allows an attacker who already has low-privilege code execution on a machine to escape an AppContainer sandbox and obtain SYSTEM privileges. Critically, it requires no additional user interaction. Sandbox escape plus privilege escalation with no user in the loop is the exact capability that turns a nuisance foothold into a domain problem, because SYSTEM on a workstation is the launchpad for credential theft, lateral movement and the disabling of endpoint protection.

The second zero-day, CVE-2026-81963, is a privilege escalation vulnerability in the Windows Update Stack that likewise grants SYSTEM-level access. Researchers assess that it is probably being paired with a separate code execution bug to spread malware or ransomware - the standard two-stage pattern in which one flaw gets the attacker onto the machine and a second one makes them administrator of it. There is a bitter irony in the location of this one: the component whose entire purpose is to keep the operating system current is itself the escalation path. Organisations that have deferred update infrastructure changes because “Windows Update is a Microsoft problem, not ours” should read that sentence twice.

The vulnerability that several researchers regard as the single most consequential fix of the month, however, is not one of the two zero-days. CVE-2026-55007 is one of nine Exchange Server flaws patched in this release, and it allows a remote, unauthenticated attacker to execute code by sending an email carrying a malicious Visio attachment. The code path triggers during content indexing - the routine background process by which Exchange makes mailbox contents searchable. No user has to open the message. No user has to click the attachment. The message arriving and being indexed is the whole exploit chain. The Zero Day Initiative’s Dustin Childs called it the most important patch of the release, and it is difficult to argue with that assessment: a mail server that compromises itself on receipt of mail is the closest thing modern enterprise software has to a wormable email vulnerability.

The Zero Day Initiative also counted 20 separate wormable bugs in this release - vulnerabilities with the potential to propagate automatically between systems without user interaction. Not every wormable-class bug becomes a worm; most never do, because weaponising one reliably is harder than the classification implies. But twenty of them in one month, in a release that also contains two actively exploited privilege escalation flaws, is a combination that deserves a deliberate response rather than the usual approach of letting automatic updates get there when they get there.

How the month unfolded

The sequence matters as much as the individual vulnerabilities, because it shows how much of the risk landed before the patches did. Two of this month’s most serious issues were being exploited in the wild while most organisations were still treating early September as a quiet week.

Where the September workload actually lands

Nine hundred and seventy-four CVEs does not translate into 974 units of work. The overwhelming majority are consumed silently by Windows Update, Microsoft 365 Apps servicing and the normal monthly cumulative rollup, and for most UK businesses they will be installed without anybody making a decision about them. The work concentrates in a small number of places: systems that need a maintenance window, systems that are internet-facing, systems that carry payment data, and systems whose patching is not automated because somebody once turned automation off to stop a reboot at a bad time.

The chart below is a planning estimate rather than a reported figure. It reflects how Cloudswitched expects the September 2026 remediation effort to distribute across a typical 40-seat UK business running Microsoft 365, an on-premises or hybrid Exchange footprint, a small server estate and a Magento storefront. Widths are relative to the heaviest workstream, not absolute hours.

Two observations follow from that distribution. The first is that the record CVE count is a poor proxy for effort: the two smallest categories by CVE volume - the two Windows zero-days and the single Magento flaw - account for a disproportionate share of the urgent work, because they are the ones with confirmed exploitation and short deadlines. The second is that the last bar, verification, is the one most often dropped. Applying a patch and confirming that it applied are different activities, and in a month where an attacker may already be resident on the machine you are patching, the second is where the value is.

The proportion nobody expected: Microsoft is 85% of the month

Add Microsoft’s 974 CVEs to Adobe’s 172 and the September total from these two vendors alone reaches 1,146. Microsoft accounts for roughly 85% of that figure. This is a genuinely unusual concentration. In a typical month, the vulnerability workload of a mid-sized UK business is spread far more evenly across operating systems, browsers, VPN appliances, backup agents, network gear and line-of-business software, and no single vendor dominates the queue. This month, one vendor does - which is both a scheduling advantage and a strategic warning.

The advantage is that concentration makes scheduling tractable. If 85% of the month’s vulnerabilities arrive through one vendor’s update channel, a single well-run maintenance window can close most of them. Businesses with a managed patching service, a properly configured update ring structure and a tested reboot policy will find that the record-breaking CVE count barely touches them operationally. It is the businesses that patch by hand, or that have exempted specific servers from automatic updates and never revisited the exemption, for whom 974 is a genuinely frightening number.

The warning is the mirror image. Concentration means correlated failure. If your patching process depends on one vendor’s advisory feed, one update channel and one administrator’s calendar, then a month like this one is exactly the month in which a single missed step leaves the whole estate exposed. The Chrome and Edge situation makes the point precisely: CVE-2026-85046 is a real, actively patched zero-day affecting the browser most Microsoft 365 businesses use, and because Microsoft has not published its own advisory, an organisation that tracks only Microsoft advisories will never see it appear in any report. The vulnerability does not care whether it was written up in the format your process expects.

Where UK SMEs are most likely to fail this month

Patch programmes rarely fail because a team does not know a patch exists. They fail at specific, predictable points - the exempted server, the hybrid Exchange box nobody wants to touch, the storefront maintained by an agency that stopped answering emails. The assessment below reflects the failure modes Cloudswitched sees most often in businesses between ten and two hundred seats, rated by how much risk each carries in this particular release.

The pattern in that list is worth naming. The high-risk rows all share a single characteristic: a human being has to decide to act, and no system will chase them if they do not. The low-risk row is the one where the default behaviour is correct and inaction is safe. Building a patch programme is largely the work of moving rows from the top of that list to the bottom - not by working harder in a crisis month, but by changing which outcomes require a decision at all.

What this month costs a UK business

The figures below are indicative planning ranges for the September 2026 release specifically, covering triage, scheduling, out-of-hours execution, verification and evidence capture. They assume the work is done properly - including confirming that the two zero-days are actually closed on every in-scope machine rather than assumed closed because a report said “compliant”. They exclude incident response, which is a different and considerably more expensive conversation.

The last row is the one that catches people out. Because StyleSmuggler was exploited from 4 September - five days before a fix existed - patching an affected storefront is not sufficient on its own. A shop that was internet-facing and unpatched during that window has to be treated as potentially already compromised, which means checking for injected payment-skimming code, unexpected administrator accounts, modified template and layout files, and scheduled tasks that were not there in August. Patching closes the door; it does not evict anybody already inside. That distinction is the difference between a £900 job and a card-data breach notification to the ICO.

Reactive patching versus a managed patch programme

A month like September 2026 is a stress test of process rather than of technical skill. The technical steps - install updates, restart, verify - are not difficult. What separates the businesses that will be finished by 12 September from those still arguing about a maintenance window on 30 September is whether the decisions were made in advance.

The distinction is not about tooling budgets. Most of the proactive column is achievable with the update management capability already included in a standard Microsoft 365 Business Premium subscription, plus a maintained list of what the business owns. What it requires is that somebody is accountable for the outcome on a defined cadence - which is precisely the thing an SME without a dedicated IT function does not have, and precisely what a managed IT support arrangement supplies.

A score of 92 out of 100 is not a claim that every business is about to be breached. It is a statement about how little slack there is in the schedule. Three vulnerabilities in this release have confirmed in-the-wild exploitation and appear in the CISA KEV catalogue. One of them was being used five days before a patch existed. One of them needs no user interaction at all. Under Cyber Essentials, critical and high-severity patches must be applied within 14 days of release, which puts the hard internal deadline for the Microsoft zero-days at 23 September 2026 - one day after the US federal deadline, and comfortably achievable for any organisation that starts this week.

September 2026 at a glance

How this fits the wider pattern

This release does not sit in isolation. It is the latest instalment in a run of stories about the gap between what an organisation believes its estate looks like and what it actually looks like. Our coverage of shadow AI in the UK workplace examined the same inventory problem from the software-adoption side - you cannot patch, govern or risk-assess a tool you do not know your staff are using. The analysis of ASCII smuggling attacks against Microsoft 365 is the closest cousin to CVE-2026-55007: both are cases where the mail platform itself processes hostile content without a user ever making a mistake. Our report on the UK’s SMS blaster fraud conviction showed what happens when attacks bypass the trust signals users are trained to check, and the piece on UK GDPR and cookie banner compliance covers the regulatory consequences that follow a customer-data incident on a storefront - consequences that a compromised Magento checkout page makes immediate. For the policy backdrop to all of it, the proposed UK AI kill-switch legislation is a useful marker of how quickly the compliance expectations around technology risk are hardening.

Frequently asked questions

CloudSwitched

London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.