September brought Microsoft's largest Patch Tuesday on record: fixes for around 974 vulnerabilities in a single month, including two already being exploited in the wild and roughly 20 flagged as "wormable." The headline number is staggering, but for a small business the useful response is not to panic at 974. It is to understand which of these actually matter to you and to make sure your machines get the fixes, promptly and reliably.
What is in this month's release
The two actively exploited zero-days are the ones to note. Both are elevation-of-privilege flaws in core Windows components (CVE-2026-85880 in a local procedure-call component and CVE-2026-81963 in the Windows Update stack) that let an attacker who already has a foothold gain much deeper control of a machine. Both have been added to the US government's Known Exploited Vulnerabilities list, which is the clearest possible signal that they are being used, not theoretical. Separately, about 20 flaws are "wormable," meaning a future exploit could spread from machine to machine on its own, without anyone clicking anything.
Why the numbers keep breaking records
If it feels like every month is now a record, that is because it nearly is. As we covered in August, Microsoft has attributed the surging patch counts largely to AI-assisted vulnerability discovery, its own and the wider industry's. The takeaway has not changed, it has intensified: huge monthly patch batches are the new normal, so the real question is not "what is in this one" but "is my patching actually keeping up, every month, without heroics."
What a small business should do
- Make sure automatic updates are on for Windows and your core software, so the routine fixes land without anyone remembering.
- Prioritize the exploited and wormable ones. The actively-attacked zero-days and wormable bugs are this month's real urgency; apply them promptly rather than deferring for weeks.
- Do not forget servers, third-party apps, and firmware, which patch separately from Windows and are common blind spots.
- Confirm it happened. "Updates are automatic" is only reassuring if someone occasionally checks that they actually applied.
The bottom line
974 is a number designed to alarm, but your job is unchanged and simple: keep your systems patched reliably and promptly, with the actively-exploited flaws first. In a world of record-breaking, increasingly wormable patch volumes, a dependable patch-management process is one of the highest-value defences a small business has, and one of the easiest to let slip.