Microsoft's Largest Patch Ever and 22,000 Exposed Exchange Servers

On September 8, 2026, Microsoft shipped the largest patch bundle in its history: 966 flaws fixed, 105 of them critical and 81 of those critical ones allowing remote code execution. For scale: July’s release had 570 fixes and August’s had 400.

Two of those flaws were already being exploited when the patch shipped. And there is a second open front: around 22,000 Exchange servers worldwide still haven’t applied August’s patch, with a working exploit circulating online.

This isn’t news for the security team alone. If your company runs Windows Server, SQL Server, Office or Exchange on its own servers, this defines what to do this week.

What September’s patch covers

The bundle spans Windows, Office (Word, Excel, PowerPoint, Outlook, SharePoint), Azure, Exchange Server and graphics components, among others. The two flaws already under attack are:

• CVE-2026-81963, in the Windows Update stack: lets an attacker gain SYSTEM privileges, meaning full control of the machine.
• CVE-2026-85880, a heap buffer overflow in Windows ALPC, which also escalates privileges locally.

Both are privilege escalation, not remote entry. That matters for prioritization: they don’t get an attacker into your network, they turn someone who already got in into an administrator. They’re usually the second step of an attack, after a malicious email or a stolen credential.

One detail that causes confusion: outlets reported different numbers (964, 966, 973, 974). That’s not a contradiction, it’s counting methodology: some include third-party and browser advisories, others only what shipped that day. The order of magnitude is the same and the conclusion doesn’t change.

The Exchange problem is more serious

In parallel, CVE-2026-62911 affects Exchange Server running on your own hardware. It’s an authentication bypass with a CVSS score of 8.0 that allows privilege escalation over the network.

The facts, in order:

• Microsoft shipped the fix on August 11, 2026.
• According to Shadowserver Foundation’s daily scans, nearly 22,000 servers were still unpatched in early September. The United States leads with 6,200 and Germany with 5,100.
• The Netherlands’ national cyber security centre warned that a working exploit is already circulating and the code is openly published.

There’s an aggravating factor that ties into the end-of-support calendar: many of those servers run Exchange 2016 and 2019, versions already out of mainstream support that require the extended updates program to keep receiving patches. An unpatched mail server, exposed to the internet, with a public exploit available, is among the most attractive assets an attacker can find: it holds all of the company’s correspondence.

What to do this week

Five concrete steps, in order of urgency:

1. Confirm whether you run your own Exchange. If your email is Microsoft 365 or Google Workspace, this doesn’t apply to you. If there’s an Exchange server in your office or a data centre, it’s priority number one.
2. Check the date of the last patch on your Windows servers. “We keep Windows Server updated” isn’t the answer: the question is which month the last applied patch is from.
3. Prioritize what’s internet-facing. First what can be reached from outside (email, VPN, portals), then internal systems.
4. Set a monthly maintenance window. A bundle of nearly a thousand fixes doesn’t get applied on a Friday at 5 p.m. Without a fixed window, every patch competes with operations and always loses.
5. Cross this with your end-of-support calendar. If a server is already out of support, patching is temporary relief: the real decision is upgrading it or migrating the service.

For step 5 we publish an end-of-support calendar with dates for .NET, SQL Server, Windows Server, Angular and Node.js, each verified against the vendor’s official source.

What this week leaves behind

Two takeaways for decision-makers, beyond the specific CVEs.

First: patch volume is growing and won’t shrink. Going from 400 to 966 fixes in a month means patching by hand, whenever someone remembers, is no longer viable. You need a version inventory, a fixed window and a named owner.

Second: unsupported software concentrates the risk. Those 22,000 exposed Exchange servers aren’t careless organizations by definition; in many cases they postponed a migration because “the server works”. It works until there’s a public exploit and your email is in plain sight.

If you want to review which versions run in your company today and which ones have an expiry date coming up, let’s talk in a 30-minute assessment. We’ll tell you what’s urgent and what can wait, even if we don’t end up working together.