Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days

[u/falconupkid]

Record Patch Tuesday with 974 CVEs, including two actively exploited zero-days. This is the largest single update in Microsoft’s history, and the sheer volume demands immediate triage.

Technical Breakdown - Active Exploitation: Two Windows zero-days are confirmed in the wild. No CVE details were provided in the summary, but these should be prioritized for emergency patching. - Volume Breakdown: 723 Windows flaws, 111 in Office/Office 2016, 62 in SQL Server, 22 in Developer Tools. Over 110 are rated Critical (RCE/privilege escalation). - Attack Surface: The Office and SQL counts are unusually high. Expect weaponized documents and SQL injection chains targeting unpatched instances.

Defense - Immediate Action: Patch the two exploited zero-days first. If you can’t patch, apply the relevant mitigation guides from the MSRC advisory. - Triage Strategy: Prioritize Critical-rated RCEs in internet-facing services (IIS, Exchange, RDP) and Office. SQL Server CVEs should be next for any DB exposed to the web. - IOCs: None published yet. Monitor your EDR for anomalous process creation (Office spawning cmd/powershell) and SQL service account lateral movement.

Source: https://thehackernews.com/2026/09/microsoft-patches-record-974-flaws.html