Microsoft's record 972-CVE Patch Tuesday undercut by same-day Windows Defender bypass

Microsoft's September 2026 Patch Tuesday addressed 972 vulnerabilities, the largest single release in the company's history, according to a write-up on dev.to — and within hours a researcher published a proof-of-concept showing that one of the cycle's most important fixes, a Windows Defender patch tracked as CVE-2026-69414, can still be bypassed.

The record release in numbers

The dev.to post puts the September haul at nearly double August's count, topping every monthly total Microsoft has recorded in roughly two decades of Patch Tuesday. Of the 972 CVEs, 113 are rated Critical. By impact, elevation-of-privilege flaws dominate with 437 fixes, about 45 percent of the total, followed by 258 remote code execution bugs at roughly 26 percent and 171 information disclosure issues at 18 percent. The remainder cover denial of service, spoofing and other categories.

By product family, Windows itself accounts for 726 patches, Office for 135, and 650 are tied to Extended Security Update programs — a measure of how much effort still goes into propping up legacy systems.

Two flaws were reportedly exploited in the wild before the patches shipped. CVE-2026-85880 is a heap buffer overflow in Windows ALPC that lets a local attacker escalate from sandboxed code to SYSTEM privileges, and CVE-2026-81963 is a privilege escalation in the Windows Update Stack itself, via improper link resolution. Both are rated CVSS 7.8.

Three strikes against Defender

The Defender story is the more uncomfortable one. Per the dev.to account, the chain began in June 2026 with RoguePlanet, a flaw in Defender's file-handling workflow that Microsoft patched in July. In August, a researcher going by Nightmare Eclipse published ShieldBreak, demonstrating that the fix was incomplete. Microsoft then assigned CVE-2026-69414, rated CVSS 7.8, and shipped a new fix in the September release through Malware Protection Engine version 1.1.26080.3.

On September 9, the same day the patches went live, the researcher released ShieldCrash, arguing the problem can still be triggered under specific conditions. The proof-of-concept, a C++ project on GitHub, bundles a DLL named Warden.dll, resource files and an EICAR test archive, which points the attack path at Defender's scanning pipeline. The claimed result: when Defender processes certain files, an attacker can force it to access protected system files using the engine's own SYSTEM-level privileges, yielding an arbitrary file read as SYSTEM on every supported version of Windows.

The post notes that Nightmare Eclipse has disclosed nine zero-days since April 2026 across Defender, BitLocker and Windows components, and that Microsoft responded to earlier disclosures by warning of legal action against researchers whose work it linked to real-world harm. The publications continued regardless.

Twenty wormable bugs, seven at 9.8

Beyond the two zero-days, the write-up counts 20 wormable vulnerabilities — flaws permitting remote, unauthenticated code execution with no user interaction, the kind that self-propagate across networks at machine speed. Several sit in services that are exposed by default in most Windows estates:

• DNS Server, CVE-2026-69730 (CVSS 9.8): unauthenticated code execution on Windows DNS servers, which CrowdStrike reportedly likened to a successor of 2020's SigRed.
• Netlogon, CVE-2026-72982 (9.8): unauthenticated domain controller compromise in the authentication backbone of Active Directory.
• DHCP Server, CVE-2026-69845 and CVE-2026-72979 (both 9.8): two separate unauthenticated RCEs in a service that listens on every subnet.
• SSTP VPN, CVE-2026-73009 (9.8): code execution on VPN endpoints that are internet-reachable by design.
• Remote Desktop Services, CVE-2026-69525 (9.8): a use-after-free enabling unauthenticated in-network code execution.
• Hyper-V, CVE-2026-69603 and CVE-2026-80083 (both 8.8): guest-to-host escapes, a particular concern for multi-tenant and hosted infrastructure.

Office preview-pane exploits

The release also carries 22 critical Office RCEs, twelve of which the post says can fire through Outlook's Reading Pane or Windows Explorer's Preview Pane without the user opening anything. Three are rated 9.8: CVE-2026-77493 in graphics rendering, CVE-2026-78510 in Word document processing, and CVE-2026-78509 in Outlook, where the email itself is the exploit. That undercuts 25 years of don't-click-attachments advice, since preview panes render hostile content automatically.

Why it matters

Three things set this cycle apart. First, a fully patched Windows system running the latest Defender engine is, on this evidence, still open to arbitrary file reads as SYSTEM — patching alone does not yet close that hole, and Microsoft has known about the underlying bug class since June. Second, seven CVSS 9.8 wormable flaws in DNS, Netlogon, DHCP, VPN and RDS concentrate risk in the very services that hold Active Directory together, which argues for emergency change windows rather than the normal cadence. Third, preview-pane exploits move part of the defense burden from user training back to configuration and patch discipline.

One caveat: every figure here traces back to a single dev.to write-up, so teams should cross-check the CVE list against Microsoft's own advisories before scoping emergency work. The broader signal the post draws — discovery outpacing remediation in aggregate — is the debate worth having once the fires are out.