974 patches in one Tuesday. 2026 has already doubled the worst year on record, with a quarter still to go.

Microsoft’s 974 patches in September: The troubling trend for vulnerability management

For most IT teams, Patch Tuesday was a monthly chore with a familiar shape. Microsoft published its fixes, security sorted them by severity, and ops pushed them through testing and out to machines. The volume shifted, but it stayed within a range you could plan staffing around.

That model is breaking. Microsoft’s September release fixed at least 974 flaws in one day, and its year-to-date count has already passed the previous annual record, with a full quarter to go. The industry-wide numbers are climbing too.

Microsoft shipped 974 fixes in one day

On September 8, Microsoft patched at least 974 vulnerabilities, 113 of them rated critical, its largest Patch Tuesday on record, according to Krebs on Security. Two were zero-days already under attack: CVE-2026-81963 and CVE-2026-85880, both Windows privilege-escalation flaws (Krebs on Security).

That’s the headline most outlets ran. The more useful number is what came before it.

Four months of releases show a trend

Here are Microsoft’s monthly counts this summer, all from Krebs: roughly 200 in June, 570 in July, 398 in August and 974 in September.

The line isn’t smooth. August came in below July, so this isn’t a curve bending steadily upward. But the direction over four months is hard to miss.

The running total makes the point more plainly. Microsoft has patched more than 2,600 CVEs so far in 2026, more than double the 1,245 it patched in 2020, the previous record year (Krebs on Security). Krebs calls this the worst year on record, and October, November and December haven’t happened yet.

For a team that sized its patch process around 2020, that means more than twice the work flowing through what’s likely the same testing windows, and probably the same people.

Microsoft blames AI, and FIRST’s forecast points the same way

Microsoft’s explanation for the surge is AI-aided vulnerability discovery: better tooling finding more flaws in its code (Krebs on Security). That’s Microsoft’s account of Microsoft’s numbers, and nobody outside the company has verified it. It’s also a slightly awkward thing to announce. The good news is the bug-finding got much faster; the bad news is whose bugs they are.

The second signal comes from somewhere else entirely. In June, FIRST, the forum of incident response and security teams, published a mid-year forecast covering every vendor, not only Microsoft (FIRST.org). It contains two numbers that are easy to blur together, so here they are separately.

• The forecast moved up. FIRST now expects about 66,000 CVEs across the industry in 2026, up from the 59,427 it forecast in February. That’s a revision of roughly 11%.
• Reality is ahead of the old forecast. Actual CVE disclosures were running 46.3% ahead of what the February forecast projected for that point in the year.

The second figure is the one I’d pay attention to. It compares what actually got disclosed against the path FIRST itself expected, and the gap is wide. Both are mid-year figures, and they’re the most recent FIRST has published.

Keep the two signals apart. FIRST’s forecast says nothing about Microsoft, and Microsoft’s explanation says nothing about the industry. Neither explains the other. They’re two independent readings pointing the same direction: a lot more vulnerabilities are being found and published.

Volume is climbing faster than FIRST’s risk-filtered tally

But here’s the catch. The same FIRST release filters the pile down to vulnerabilities with real-world risk signals. That means entries in CISA’s Known Exploited Vulnerabilities catalog or an EPSS score above 10% (FIRST’s threshold for “likely to matter” in real-world context). On that filtered view, FIRST says the patching burden “has not materially increased, despite the surge in raw volume” (FIRST.org).

EPSS, the Exploit Prediction Scoring System, estimates a probability of exploitation; it isn’t a record of attacks, and FIRST’s counts date from May. What FIRST is saying is that the slice of vulnerabilities flagged as most likely to matter hasn’t grown in step with the total. But the dangerous fraction is shrinking relative to volume, which makes it harder to find, not easier to manage.

September’s two exploited zero-days might seem to contradict this, but they don’t. Two actively exploited flaws inside a release of 974 fits the pattern FIRST’s numbers imply: a small number of dangerous vulnerabilities sitting inside a much larger pile of ones that carry little near-term risk on their own. A flat aggregate doesn’t mean no month contains live exploits. It means the dangerous fraction is shrinking relative to everything around it, which makes it harder to find.

FIRST’s own people frame it the same way. Éireann Leverett, FIRST’s liaison, put it this way: “The challenge for defenders is no longer the discovery of vulnerabilities; it’s the capacity to verify, coordinate, and prioritize them at a scale the industry has never seen before” (FIRST.org). Jerry Gamblin, a co-author of EPSS, was blunter: “In 2026, the rain doesn’t stop. The job is no longer counting the drops. It’s knowing which ones will overrun the levee” (FIRST.org).

So the planning problem is a search problem. Finding the exploitable few gets harder as the pile grows, and that search starts with knowing what you’re running.

Microsoft is one software provider in a stack of hundreds

Everything above is about Microsoft or the industry total. Your exposure depends on your own stack, and Microsoft is one entry in it.

Our 2026 SaaS Benchmark report found the average organization runs 831 discovered applications (median 680), and the average enterprise with 4,000 or more employees runs 2,191. Those counts cover the whole discovered inventory: sanctioned apps, shadow IT, and apps that are blocked or still under review.

Most of those apps will never ask you to patch anything. A typical SaaS tool gets fixed by its provider on its own servers, and the customer never sees an update. So I’m not arguing that patch work scales with app count. It shouldn’t.

The obligation sits in a smaller, harder-to-see group: on-prem components, self-hosted instances, agents installed on endpoints, browser extensions. Those are the places where a vendor’s fix does nothing until someone on your side applies it.

Which raises the question the benchmark can’t answer. With hundreds or thousands of discovered apps in a typical stack, how many teams could actually name which ones carry a Microsoft-style patch obligation? Our report counts apps, not how each one is hosted, so it doesn’t measure how big that group is. My guess is that most teams couldn’t answer quickly, because the people who own the patch queue and the people who own the app inventory are often different teams, and the shadow part of the inventory frequently has no owner at all.

That’s why this lands well outside the security team. Security can triage a list of CVEs, but it can’t triage an app nobody knows is installed. The IT or ITAM lead owns the list that says what’s there. And the finance lead pays for all of it in hours, because every fix that needs testing and deploying is somebody’s time, and Microsoft’s volume alone has more than doubled.

An application discovery tool is one way to build the first half of that answer. Torii, for example, maintains an inventory of discovered applications across sanctioned and shadow IT, which is where the benchmark figures above come from. It doesn’t scan for vulnerabilities, track patch status or classify apps by hosting type, so it tells you what’s there, and someone still has to work out which of those apps need patching on your side.

A quarter is left in a year that has already doubled the record

Three Patch Tuesdays remain in 2026. Even three quiet months would leave it as Microsoft’s biggest year by a wide margin, since the total is already more than double 2020’s.

The standard advice this cycle, which Tenable’s Satnam Narang also gave in Krebs’s coverage, is to prioritize remediation by risk context rather than volume. That’s right as far as it goes, but prioritizing assumes you already have the list.

FIRST’s numbers say the risky slice is holding roughly steady. Microsoft says the pile around it keeps growing. Next year, will vulnerability management budgets go to patching faster, or to finding out what there is to patch in the first place?