A record 974 Microsoft fixes turn Patch Tuesday into a sequencing job

The release gets split into rings, and somebody has to decide what goes into the first one. Microsoft's severity field does not settle it. More than 110 of the fixes carry the company's highest rating ^[8], about one item in nine ^[2], with no order inside the bucket. Two flaws are rated 9.8 out of 10, one in Outlook and one in Remote Desktop Services ^[15][16], and the same number sits on different work: the Outlook bug fires through the Preview Pane, so a person has to preview a message first ^[15].

Preconditions sort the queue better than scores do. Both exploited zero-days need an attacker who already has a foothold on the Windows machine ^[3]. The Exchange Server flaw needs no account at all, because the code runs when the server processes an email carrying a rigged Visio attachment ^[13]. The Authenticator flaw on Android needs a malicious app already on the phone and a user who completes a sign-in, which Childs called the "worst type of privilege escalation" because it abuses the authentication system itself ^[17]. Two questions do most of the work: does the attacker have to be inside already, and does a human have to do something.

That framing is also how the Update Stack bug shrinks. Childs doubts attackers have hijacked the update mechanism itself, and his more likely reading is that they pair the Update Stack flaw with a code execution bug to spread malware or ransomware; on both zero-days his advice is to patch quickly ^[6]. If the pairing is what makes the privilege escalation worth having, the code execution holes reachable without an account belong in the same maintenance window as the zero-day, and the Exchange bug is one of them ^[13].

The headline count depends on who is counting. Microsoft's notes list 974 of its own CVEs and republish 25 more from other vendors, while Childs counts 972 new ones, or 997 with the Chromium fixes that ship inside Edge ^[7]. That is a spread of 25 between the lowest and highest figure ^[8]. The monthly totals are steadier: roughly 570 in July's record release and about 620 in August ^[9], which puts September around 57 percent above August ^[3]. Against Ars Technica's year-to-date count of 2,760 ^[10], this one release is about 35 percent of the year ^[4].

Some of the volume reads like one tool pointed at one target. Windows DHCP Server alone has 36 fixes, and Childs suspects someone aimed a fuzzer at the way it parses network packets, probably with AI help ^[20]. The Windows Biometric Service has 64, of which 56 are the same kind of heap overflow, "one bug class, stamped 56 times" in his words ^[21]. Those two components account for 100 fixes, roughly a tenth of the release ^[7]. Childs opened his review with a phrase from his military days, "embrace the suck" ^[11], and warned that "AI-assisted vulnerability discovery shows no signs of slowing down" ^[12]. Among more than 60 SQL Server fixes is one in SQL Copilot: crafted instructions submitted to the assistant inside SQL Server Management Studio reach the database with the user's permissions ^[22].

One workable ordering has three rings. Ring one is anything that needs neither an account nor a human, which is the 20 wormable bugs in DHCP, DNS, Netlogon, Message Queuing and SMB ^[18] plus Exchange. Ring two is the two zero-days and the rest of the local privilege escalations. Ring three is everything that waits on a user previewing a message or tapping through a sign-in. For an estate with no sign of an intruder, that puts the flaws attackers are already using behind the ones that travel on their own, and it puts domain controllers at the front, because the Kerberos flaw lets any domain user run code with one crafted request and Microsoft rates it as more likely to be exploited ^[19].