Microsoft Patch Tuesday Update Fixes Record 974 Vulnerabilities, Warns of Wormable Flaws

Microsoft has released its largest Patch Tuesday update on record, fixing 974 vulnerabilities in September 2026. The update includes two exploited zero-days that security researchers have identified as critical.

The most concerning vulnerability is CVE-2026-69730, a Windows DNS Server flaw with a CVSS score of 9.8. Dustin Childs of Trend Micro's Zero Day Initiative compared it to the SigRed vulnerability disclosed in 2020, saying that 'with a DNS flaw acting as the spiritual successor to SigRed, that reality could change fast.'

Other infrastructure targets include DHCP, Remote Desktop Services, Netlogon, NFS and Exchange Server. The company has also identified 20 vulnerabilities as potentially wormable because they may allow unauthenticated attackers to remotely execute code without user interaction.