Microsoft's September Patch Tuesday revealed 964 vulnerabilities, the highest count since the company began using AI for vulnerability discovery mid-year. Two zero-days are already being exploited. SAP disclosed a critical flaw with a CVSS score of 10.0. The real story isn't the volume; it's how AI-driven discovery is outpacing your team's ability to respond.
The Shift in Vulnerability Discovery
AI-assisted vulnerability discovery has changed the landscape of patch management. Microsoft's September release highlights this shift: 964 fixes require action, plus 174 third-party/open-source CVEs and 23 Chromium/Edge CVEs not included in the count. Additionally, nine vulnerabilities in Azure, Entra, and Copilot Studio were mitigated without customer action.
Two zero-days demand immediate attention. CVE-2026-85880, a heap-based buffer overflow in Windows ALPC, allows attackers to escape the sandbox and elevate privileges. It's already being exploited. CVE-2026-81963, an escalation of privilege in Windows Update Stack, affects Windows 11 Desktop and Windows Server 2025 and has also been exploited.
SAP Security Note #3747649 addresses a memory corruption vulnerability in the Extended Passport Processing component. This flaw is present by default in SAP S/4Hana and NetWeaver, is remotely exploitable without authentication, and allows attackers to run arbitrary operating system commands with SAP administrative privileges.
Key Findings
AI is creating larger haystacks, not more needles. The number of disclosed vulnerabilities has increased, but the proportion that applies to your specific environment and poses real risk remains small. Your challenge is identifying which vulnerabilities matter for your infrastructure.
CVSS scores no longer drive effective prioritization. The September release included about 20 potentially wormable bugs. CVE-2026-69730, a Windows DNS remote code execution vulnerability, hadn't been exploited as of the disclosure date, but Microsoft expects it will be. An unauthenticated attacker can exploit it by sending a specially crafted packet over the network. CVSS alone won't tell you if this vulnerability exists in your internet-facing DNS infrastructure or an isolated internal segment.
Unauthenticated, network-reachable vulnerabilities concentrate real risk. SAP's September release included three Security Notes that allow full compromise without valid credentials. The OVERPASS vulnerability (CVE in SAP Security Note #3747649) is accessible through several SAP components and communication protocols. No single network control can fully mitigate the risk because the attack surface spans multiple entry points.
Legacy prioritization frameworks are breaking under volume. Evaluating 964 vulnerabilities in a single month collapses the traditional read-assess-test-deploy cycle. You can't manually assess exploitability, network exposure, privilege requirements, business criticality, and compromise consequences for each CVE. You need automated context about which systems in your environment are affected and which are reachable from untrusted networks.
Zero-days in foundational components demand different response protocols. CVE-2026-81963 is the first zero-day among seven privilege escalation flaws discovered in Windows Update Stack since 2022, and the first to be exploited. When the update mechanism itself becomes an attack vector, your standard patching workflow creates a circular dependency. You need out-of-band deployment capabilities for these scenarios.
Implications for Your Team
You can't scale manual triage to match AI-accelerated discovery. If your current process involves security analysts reading CVE descriptions and manually determining applicability, you're already behind. The gap will widen.
Your patch management tools need to answer three questions automatically: Is this vulnerability present in our environment? Is the affected system reachable from an untrusted network? What's the business impact if this system is compromised? Without automated answers, your team will default to CVSS-driven prioritization, which means you'll patch high-scoring vulnerabilities in isolated lab systems while leaving exploitable flaws in internet-facing infrastructure unaddressed.
The rise in patch volume also exposes weaknesses in your change management process. If your deployment windows are already constrained, adding 300% more patches doesn't give you 300% more time. You need either more frequent deployment windows or a risk-based framework that lets you defer low-risk patches without formal exception processes.
Action Items by Priority
Immediate (this week): Determine if CVE-2026-85880 or CVE-2026-81963 affect systems in your environment. Both are actively exploited. If you run SAP S/4Hana or NetWeaver, verify whether SAP Security Note #3747649 applies to your kernel version. The OVERPASS vulnerability is remotely exploitable without authentication and provides full system compromise.
This month: Audit your patch prioritization criteria. If you're still using CVSS as the primary ranking factor, you're optimizing for the wrong outcome. Build a prioritization model that incorporates exploitability (is there a public exploit?), network exposure (is the vulnerable service reachable from untrusted networks?), privilege requirements (does exploitation require authentication?), and business criticality (what's the impact if this system is compromised?).
This quarter: Evaluate whether your patch management tools can automatically map CVEs to your asset inventory and provide network reachability context. If your team is manually determining which systems are affected by each vulnerability, you need better tools. Look for solutions that integrate with your CMDB, network scanning tools, and vulnerability scanners to provide automated risk context.
Ongoing: Establish exception criteria for low-risk patches. You can't deploy everything immediately, so define what "low-risk" means in your environment. For most organizations, this includes vulnerabilities that require local access or user interaction, affect systems not reachable from untrusted networks, or exist in non-production environments. Document these criteria so your team can defer patches systematically rather than arbitrarily.
