Microsoft's 970-CVE Patch Month Pushes Teams Beyond CVSS-Only Triage

A patch cycle at record scale

Microsoft's September 2026 security update landed with somewhere between 970 and 997 CVEs, depending on how third-party and Chromium-derived components are counted, and more than 110 of them carried a critical rating. Chinese security outlet FreeBuf put the headline figure at 974 and counted two exploited zero-days plus 20 wormable flaws, while InfoQ reported more than a thousand fixes in a single month. The precise number matters less than the shape of the problem: a monthly ritual built around a few dozen decisions now has to absorb an input approaching four figures.

A dev.to analysis published after the release argues that the real story is the triage question, not any individual vulnerability. At this volume, a score-sorted process no longer produces a defensible ordering.

Where the volume comes from

According to the dev.to piece, Microsoft has closed roughly 2,750 vulnerabilities so far in 2026, against about 1,250 in all of 2020. Security commentators credit much of the growth to AI-assisted discovery tools that surface bugs faster than the downstream evaluation process can absorb them.

CISA's review of 2024–2025 exploitation data points the other way: the flaws attackers actually used were frequently older, well-understood defect classes identified years earlier. New findings are multiplying, but exploitation stays concentrated in familiar conditions.

A five-tier ordering

The dev.to analysis proposes ordering patches by exploitation evidence and reachability rather than CVSS base score.

Tier 1 is confirmed exploitation: anything in CISA's Known Exploited Vulnerabilities catalog, or with vendor confirmation of in-the-wild use, goes first regardless of score. September's tier included the Windows Update Stack and ALPC privilege escalation flaws (CVE-2026-81963 and CVE-2026-85880), the SonicWall SMA1000 pair (CVE-2026-83548 and CVE-2026-83549), a JFrog Artifactory authentication bypass (CVE-2026-82329), a Kestra command injection (CVE-2026-49869) and a LiteLLM authentication flaw (CVE-2026-59822).

Tier 2 covers pre-authentication remote code execution on internet-reachable services, the class an outside attacker can hit with no credentials. Reported examples include Windows DNS Server (CVE-2026-69730), Remote Desktop Services (CVE-2026-69525), RRAS (CVE-2026-69852), SSTP (CVE-2026-73009) and the NFS ONCRPC XDR driver (CVE-2026-70585).

Tier 3 holds mail- and file-triggered RCE. The Exchange Server use-after-free CVE-2026-55007 sits here because it fires when a message carrying a malicious Visio attachment arrives; the recipient never has to open it. Flaws needing no user action sidestep awareness training entirely, which justifies a faster clock than the general cycle.

Tier 4 is local privilege escalation without confirmed exploitation, less urgent than tier 1 but still the pivot of most attack chains. Tier 5 is everything else, on a risk-based schedule.

Why CVSS sorting breaks down

A 7.8 local privilege escalation and a 9.8 pre-authentication RCE can both be labelled critical, but only one requires an existing foothold. Ranking a thousand entries by score yields a list that looks rigorous while saying little about patch order, and the two actively exploited LPE bugs end up buried mid-tail among dozens of equal-looking 7.8s. The KEV catalog fixes part of this by encoding observed exploitation rather than theoretical severity, but its coverage is retrospective: a vulnerability can be exploited before anyone lists it.

Making the rule work in practice

The dev.to piece pairs the tiers with process advice. Publish tier definitions before the release so ordering debates happen without time pressure. Automate the assignment, since KEV membership, authentication requirement and network reachability are machine-readable and manual triage cannot scale to four figures. Treat deciding to patch and deploying it as separate problems, because pushing an update to a thousand servers is usually the bottleneck. Track deployment completion rather than approval, since a signed change record is not proof the update applied. Recheck the rule against outcomes and adjust it if a quarter's exploited bugs clustered in a tier the ordering had deprioritized.

The author is explicit about limits: the counts vary between sources because of differing treatment of Chromium and other non-Microsoft components, and the tier assignments reflect reporting at the time and should be re-derived each month rather than copied forward.

Why it matters

If AI-assisted discovery keeps inflating release sizes — 2,750 fixes in nine months against 1,250 for all of 2020 — the monthly Microsoft cycle stops being something a human can eyeball. Teams that still sort by CVSS will spend their urgency on theoretical severity while exploited bugs wait in a long tail. An exploitation-first rule, defined in advance and automated, turns an unmanageable dump into a sequenced queue, and it points effort at what CISA's data says attackers actually do: reuse old, well-understood bug classes rather than chase novelty.