974 CVEs in One Patch Tuesday: Why MSPs Can't Patch Their Way Out of September 2026

The news: a record nobody wanted

On September 9, 2026, Microsoft shipped fixes for 974 CVEs in a single Patch Tuesday, the largest release in the program's history [1][3][4]. Two of those CVEs, tracked as CVE-2026-85880 and CVE-2026-81963, were already being exploited in the wild before the patch landed [10][11]. Security Affairs counted 20 of the flaws as wormable, meaning they can propagate across a network without user interaction once an attacker has a foothold [6].

If you noticed the count wobbling depending on which outlet you read, you weren't imagining it. Tenable logged 964 [11], BleepingComputer logged 966 [12], NTCompatible logged 973 [19], and the headline number most outlets settled on was 974 [1][3][4]. That spread exists because vendors, researchers, and news desks were tallying at different moments as Microsoft's own advisories updated. The exact number matters less than the direction it's moving: up, again, for the second month running, after a 751-CVE release in August [13] that already had the industry using the phrase "patch apocalypse" out loud [20].

Every Windows environment touched by this release is affected. That includes Windows 11 builds patched under KB5124008 [15] and the server and endpoint fleets most MSPs manage on a recurring cycle. If you run clients on Windows, you have work to do. The question this article answers is what kind of work actually reduces risk before the next release lands.

Why volume alone breaks the old playbook

The traditional MSP patch cycle assumes a testable, deployable, verifiable rhythm: stage the update, push it to a ring, confirm no regressions, expand the ring, close the ticket. That rhythm was built for double-digit or low-triple-digit CVE counts. It was not built for 974, arriving on top of 751 the month before, arriving on top of whatever July looked like.

Help Net Security's forecast for this cycle put it plainly: the ask from defenders isn't smarter tooling, it's more time [18]. Time is the one resource nobody is issuing more of. A large chunk of the September release is severe enough to warrant emergency patching, but emergency patching for 974 CVEs across a multi-client MSP book, each client with its own change windows, its own line-of-business software that might break, its own approval chain, is not a Monday problem. It's a multi-week problem, and the two zero-days aren't waiting for your change window.

That's the gap this article is actually about. Between "patch released" and "patch fully deployed across every managed endpoint," there is an exposure window. For 20 wormable bugs and two actively exploited zero-days, that window is where the damage happens, not before it and not after.

What actually happens inside the exposure window

An attacker who has working exploit code for CVE-2026-85880 or CVE-2026-81963 doesn't need every unpatched machine, they need one. From there, the sequence is depressingly familiar to anyone who has read an incident report this year: initial exploitation, privilege escalation to gain admin or system-level rights, then lateral movement to find the domain controller, the backup server, or whatever else makes the intrusion worth the trouble. Wormable flaws compress that timeline further, because the malware does the lateral movement for the attacker.

Patching closes the door those techniques walk through. But patching 974 doors on a realistic MSP timeline means some doors stay open for days or weeks, and that's the part vulnerability scanners and ticket queues can't fix by themselves. A scan tells you a door is unlocked. It does not tell you someone is already inside.

What a partner should actually do this week

Specificity matters more than urgency here, so instead of "patch immediately," here's a workable sequence:

Triage by exploitation status, not by CVSS score alone. CVE-2026-85880 and CVE-2026-81963 are being actively exploited right now [10][11]. Those two move to the front of every queue regardless of what else is scored higher. A 9.8 sitting quietly in a lab is a lower priority this week than a 7.5 with exploit code circulating.

Segment your client book by exposure, not by contract size. Internet-facing Windows services, RDP-adjacent infrastructure, and anything already flagged by CISA's Known Exploited Vulnerabilities catalog gets staged first. Everything else follows on the normal cadence.

Assume a gap and plan for it. Even a disciplined MSP moving fast will have unpatched endpoints for days. That's not a failure of process, it's arithmetic. The plan for that gap can't be "patch faster," because faster than possible is not a speed. It has to be visibility into what's happening on those endpoints while they wait in the queue.

Stop treating detection and patching as sequential. They're parallel tracks. Patching closes the vulnerability. Detection covers you while it's still open, and it keeps covering you afterward, because 974 CVEs in one month all but guarantees something in that pile has a bypass nobody's found yet.

Where Vijilan's Global SOC fits into this specific mess

Vijilan doesn't patch your clients' endpoints. That's your job, or your RMM's job, and we're not interested in pretending otherwise. What our Global SOC does is watch what happens on those endpoints during the window between disclosure and full remediation, and after it, because attackers don't stop trying once a patch ships, they just get more specific about who they're trying it against.

That's where ThreatRespond™, our Managed XDR built on ingest from CrowdStrike Falcon, Microsoft Defender and Sentinel, and monitored EDR sources including SentinelOne, earns its keep. Instead of waiting on a scan result, our analysts are looking for the behaviors that follow exploitation of exactly this kind of vulnerability: a process suddenly running with elevated privileges it shouldn't have, an account authenticating somewhere it's never authenticated before, lateral movement between hosts that don't normally talk to each other. Those are the signatures of privilege escalation and lateral movement, the two moves an attacker has to make between "got in through an unpatched flaw" and "did something that costs your client money."

For partners managing this release across dozens of client environments, that's the practical value: your patch cycle runs on the timeline it runs on, and our SOC covers the exposure that timeline creates, in real time, without asking you to hire a night shift. We never compete with our partners for their clients. We sit behind your stack and behind your brand if you want it white-labeled, watching for the moment a 974-CVE Tuesday turns into an actual incident, so your team can keep working the patch queue instead of splitting attention between remediation and round-the-clock monitoring.

If you're an MSP still working through this release, that's the conversation worth having before the next Patch Tuesday makes this one look small. Talk to us at /msp, and if the first question is what this costs, the honest answer lives at /pricing, not in a blog post trying to guess your environment.

Frequently asked questions

How many CVEs did Microsoft patch in September 2026?

Coverage varies by outlet and by the moment the tally was taken, ranging from 964 to 974, with 974 the figure most widely reported. It is the largest single Patch Tuesday release on record.

Which two vulnerabilities were being actively exploited?

CVE-2026-85880 and CVE-2026-81963 were confirmed as actively exploited zero-days in Microsoft's September 2026 release.

Can an MSP realistically patch 974 CVEs before attackers exploit them?

Not within a single change window across a multi-client book. That gap is exactly why post-exploitation detection, not patch speed alone, has to cover the exposure period.

What does Vijilan do differently during a release like this?

Vijilan's Global SOC monitors for the privilege escalation and lateral movement behaviors that follow exploitation, using ThreatRespond™ Managed XDR across ingest sources like CrowdStrike Falcon, Microsoft Defender, and Sentinel, so exposure is covered while patching is still in progress.