Windows 11’s September 2026 update has generated a lot of discussion, but most people are focused on new features like finally being able to move the taskbar to the left or right sides of the screen and resizing the Start menu. In fact, there’s another major point: security patches, and the sheer number sets a new Microsoft record. A total of 974 CVEs are listed, including two Windows privilege escalation vulnerabilities that have already been actively exploited by attackers. Microsoft also noted that AI not only helps find software vulnerabilities faster, but attackers can also use the same technology to speed up vulnerability analysis, so it urges all users to update right away.
Image source: Windows Latest
Windows 11’s September update patches 974 vulnerabilities in one go! 2 zero-day flaws have already been exploited—Microsoft urges you to stop putting off the update.
According to a report from Windows LatestIn Microsoft’s routine Patch Tuesday security updates released on September 8, a total of 974 Microsoft CVEs were listed. That number is quite staggering, but it should be made clear that this does not mean “Windows 11 itself has 974 vulnerabilities,” so there’s no need to be overly concerned.
The 974 refers to the total count across the entire Microsoft product line, covering not just Windows but also products such as Office, SQL Server, Azure, Exchange Server, SharePoint Server, and development tools. Among them, 723 are Windows products, and this category also includes Windows 11, other Windows versions, and Windows Server.
After comparing Microsoft’s CVE data with update versions, Windows Latest calculated that there are approximately 611 unique vulnerabilities corresponding to Windows 11 24H2 and 25H2.
| September 2026 Security Patch Scope | quantity | Explanation |
|---|---|---|
| Microsoft security update | 974 | CVE vulnerabilities covering all affected Microsoft product families |
| Windows product family | 723 | Security vulnerabilities in Windows and Windows Server |
| Windows 11 24H2 and 25H2 | 611 | In the September 2026 security update, the number of unique CVEs for Windows 11 24H2 and 25H2. |
The most important fixes this time are for two zero-day vulnerabilities that have already been exploited in the wild:
- CVE-2026-81963 appears in the Windows Update Stack, which is the underlying component responsible for Windows updates. This vulnerability has a CVSS score of 7.8, and the main issue is that the system does not properly handle file links before accessing files. An attacker who has already gained low-privilege local access could further exploit this vulnerability to elevate privileges, ultimately gaining SYSTEM-level privileges.
- CVE-2026-85880 affects Windows Advanced Local Procedure Call (ALPC), which is the mechanism Windows uses internally for programs and system services to communicate with each other. This vulnerability also has a CVSS score of 7.8, and it primarily involves a heap buffer overflow that, if successfully exploited, could also lead to privilege escalation to SYSTEM. However, according to Microsoft’s published list of affected products, it currently does not include Windows 11 24H2 and 25H2.
In plain terms, attackers usually first get into a computer through malicious files, phishing emails, or other vulnerabilities, and then use this kind of privilege escalation issue to gain the highest system privileges in Windows.
This month’s patches also cover many Windows core components, including Windows Hello, Windows Biometric Services, Windows Graphics Kernel, Windows Shell, Remote Desktop, and networking features. Of course, that doesn’t mean every vulnerability has already been exploited.
Microsoft 365 Director Jeremy Chapman noted that for quality updates like those in September 2026, deferring installation should not exceed three days; if the update deadline is set to 0–1 days, the grace period should not exceed two days. In other words, the sooner such security updates are installed, the better, and it is not recommended to pause Windows Update for extended periods.
This time, users of Windows 11 24H2 and 25H2 receive update KB5124008. After installation, Windows 11 25H2 will upgrade to OS Build 26200.9445, while 24H2 will come to OS Build 26100.9445.
If you want to confirm whether the update has been successfully installed, press “Win+R”, type `winver`, and press Enter to check the current OS Build. If it is still lower than the above version, you can go to “Settings → Windows Update” to manually check for updates:
Many people may be wondering why the number of patches in 2026 suddenly surged so high. Microsoft had already hinted back in May this year that Patch Tuesday would keep growing in scale. Behind this trend is not just AI, but also the rising number of vulnerability reports year over year, greater participation from external researchers, and the maturation of automated verification tools.
Microsoft engineers now also use a multi-model AI scanning system to analyze code paths and configurations, uncovering issues that were previously difficult to inspect at scale manually, then handing them to the existing MSRC process for verification, classification, and remediation.
Source: KOCPC Chinese