974 CVEs in One Month: Mapping the Windows Patch Surface With Internet-Wide Data

Microsoft's September 2026 Patch Tuesday fixed 974 CVEs, including two exploited zero-days (CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in ALPC). Vulnerability management teams usually read such releases as internal work queues. Internet asset mapping adds a second, external view: which Windows-exposed services sit on public IPs, which of them leak version information, and how the patch backlog translates into a measurable external footprint.

From patch counts to external footprint

A Windows server missing September's fixes does not advertise the fact, but the services it runs often do. RDP, SMB, IIS, Exchange OWA, and remote access components all expose version and configuration signals that mapping platforms index. The useful question for a team facing 974 fixes is not "how many CVEs affect us" but "which of our systems present an external face that maps onto the exploited or wormable subset."
September's release included 438 elevation-of-privilege issues, 257 remote code execution issues, and 20 wormable-class vulnerabilities. The EoP bugs mostly matter after a foothold exists. The RCE and wormable subset maps directly onto external exposure: an internet-reachable system running affected remote access components is a different risk object from an internal workstation with the same patch level.

Three mapping queries that operationalize the queue

1. Enumerate external RDP and remote access surfaces per organization or per ASN, so the exploited zero-day triage (both September zero-days are local, post-compromise bugs) gets paired with exposure triage of the remote-facing services where an RCE foothold starts.
2. Index Exchange OWA and other webmail surfaces separately. The September bulletin included a Critical Exchange RCE triggered via a Visio file over email, and OWA instances visible from the internet are the population where that path opens first.
3. Verify post-patch disappearance: after deployment, external banners and service versions shift, and mapping data can confirm the external footprint shrank, complementing internal patch compliance reports. Mapping platforms such as ZoomEye support these query patterns through product, service, and version fingerprints (https://www.zoomeye.org/).

What mapping cannot do

External fingerprinting does not see patch levels behind firewalls, and version banners lag the underlying build in cloud and containerized deployments. The two zero-days are local privilege escalations, which mapping cannot detect at all; they require internal inventory. The honest division of labor: internal tools own patch state, mapping owns the external face, and the queue priority comes from joining the two.

Limitations

This article synthesizes published September 2026 advisories and media reporting. No live mapping queries were executed for publication in this piece; the query channel was unavailable at writing time. Counts and CVE designations come from the cited sources.

References

• Microsoft MSRC September 2026 release notes (msrc.microsoft.com/update-guide/releaseNote/2026-Sep)
• FreeBuf coverage of the record Patch Tuesday, September 9, 2026
• Huawei Cloud advisory summary, September 9, 2026