Every second Tuesday, IT teams brace for Microsoft's monthly security drop. This week, they got hit by a truck. September's Patch Tuesday fixed 974 vulnerabilities — a record by a wide margin — including two privilege-escalation zero-days already being exploited in the wild, and 20 flaws rated as potentially wormable. That last number is the one keeping defenders up at night.

A wormable vulnerability is one an attacker can exploit across a network without any user interaction — no phishing link to click, no document to open. The malware just moves. Twenty of them in a single patch batch is an extraordinary figure. Even if only a handful are ever weaponised, the blast radius of a self-propagating exploit across unpatched Windows environments would be severe.

The two confirmed zero-days are both privilege-escalation bugs, meaning attackers are already using them to turn a foothold into full system control. Microsoft hasn't published detailed victim telemetry, but active exploitation at the time of disclosure typically means these have been in criminal or state-sponsored hands for at least weeks, possibly longer.

Why this batch is different

Patch Tuesday counts have been climbing for years as Windows surfaces expand — more cloud integrations, more AI features, more attack surface. But nearly a thousand CVEs in one month suggests something shifted in how Microsoft is counting or bundling fixes, not just that bugs are multiplying. Security researchers are already picking through the advisory list to understand whether this reflects genuine volume or a change in disclosure methodology. Either way, defenders have to act on every one of them.

The 20 wormable flaws sit across various Windows components, though Microsoft has been cagey on specifics until patches are more widely applied — standard practice, but frustrating for defenders trying to triage. Network services and remote desktop components are historically fertile ground for this class of bug, and the advisory language points in that direction.

What defenders need to do right now

Patch. That's the short answer. The two exploited zero-days should be treated as emergency fixes regardless of your organisation's standard patch cadence. For the wormable flaws, anything exposed to the network — especially remote access and file-sharing services — should be prioritised before the week is out.

For Australian organisations, the Australian Cyber Security Centre (ACSC) consistently includes Microsoft products in its top targeted technologies list, and the ASD Essential Eight specifically calls out patching of internet-facing services within 48 hours for higher maturity levels. A batch this large, with active exploitation confirmed, falls squarely in that category.

What to watch

Expect proof-of-concept exploits for the more interesting wormable bugs to surface within days. Ransomware operators in particular have a well-documented habit of reverse-engineering Microsoft patches to build exploits shortly after disclosure — the patch itself becomes a roadmap. If your org hasn't applied these fixes by the weekend, assume someone is already working on a way in.

The broader question — why did Microsoft end up with 974 fixes in a single month — deserves an answer. Watch for a post-mortem from researchers once the dust settles.