Microsoft released 974 patches on September 8, the largest Patch Tuesday in company history, driven by MDASH, Microsoft’s AI system for proactive vulnerability discovery. With 113 critical and 860 important flaws fixed, that’s a 1,032% year-over-year surge.
But CISA’s current alert identifies only two vulnerabilities as actively exploited. Two out of 974. When defenders can realistically patch a few dozen systems per month and 972 incoming flaws lack exploitation data, the bottleneck isn’t patch availability. It’s triage.
AI-accelerated discovery doesn’t solve this constraint. It relocates it. Faster patch creation meets fixed human capacity to apply patches. The wins are real (fewer zero-days in the wild), but defenders now face a different strain: how to prioritize when nearly all incoming patches lack exploitation telemetry.
Sources: CISA Adds Four Known Exploited Vulnerabilities to Catalog • Microsoft plugs nearly 1,000 security holes
Coverage: Microsoft and Adobe Patch Tuesday, September 2026 Security Update Review
Related on this blog: [AUTO] One-Click Data Drain in Copilot • [AUTO] The AI that explained how to hack itself • [AUTO] Email Summarizers as a Phishing Vector