Nearly 1,000 patches in a month: what should teams change?

TL;DR: September 2026 brought 995 Microsoft patches, 119 critical vulnerabilities and two actively exploited zero-days, according to Action1, but the real issue is that discovery and exploitation are outpacing the capacity to assess, prioritise and safely remediate them. Risk-based remediation now matters more than calendar-driven patch cycles.

Editorial analysis by NHI Mgmt Group, based on content published by Action1: “Nearly 1,000 Patches in a Month: Why the Old Patching Model Is Breaking Down”.

By the numbers:

• September 2026 delivered 995 Microsoft patches, including 119 Critical vulnerabilities and two actively exploited zero-days, according to Action1.
• CrowdStrike reported that 88% of exploitation involving vulnerabilities with public proof-of-concept code occurred within 48 hours of PoC release, according to Action1.

Key questions

Q: What breaks when organisations rely on calendar-based patching for high-volume releases?

A: Calendar-based patching breaks when vulnerability disclosure and exploitation move faster than the next maintenance window.

Q: Why do vulnerabilities become more dangerous when privileged identities are attached to the affected system?

A: A software flaw becomes more dangerous when the impacted system can reach privileged accounts, tokens, or secrets stores, because attackers can convert one foothold into broader access.

Q: What are the warning signs that patch prioritisation is failing?

A: The clearest signs are a backlog dominated by critical flaws, repeated exceptions for internet-facing assets, and remediation orders that ignore where privileged data or admin reach actually sits.

Practitioner guidance

• Define risk-based remediation tiers Classify assets by exposure, business criticality and privilege so that patch urgency reflects blast radius rather than release size alone.
• Separate identity systems from standard maintenance queues Create a distinct approval path for identity infrastructure, privileged platforms and systems whose compromise would expand access across the environment.
• Measure remediation latency in three points Track the time from disclosure to environmental identification, from identification to decision, and from decision to mitigation or patch.

Bottom line: Record patch volume is only part of the problem, because the harder issue is deciding what matters first when vulnerability discovery accelerates.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →