Microsoft Patch Tuesday Hits Record 974 CVEs as Adobe Drops Zero-Day Fix

Enterprise security teams face an unprecedented workload after Microsoft issued a staggering 974 Common Vulnerabilities and Exposures patches in a single update cycle, shattering previous monthly records. This historic software update volume follows a steady climb in reported flaws, compounding operational pressures on IT departments tasked with maintaining infrastructure defense. Alongside Microsoft's massive security drop, Adobe released urgent fixes for an actively exploited zero-day vulnerability affecting global e-commerce platforms. The simultaneous influx of high-volume updates highlights a broader industry crisis in software assurance and vulnerability management.

Why Did Microsoft Issue 974 CVEs This Month?

Microsoft released updates for 974 CVEs in its proprietary products during the September Patch Tuesday release cycle, eclipsing the 421 patches issued in August and 622 in July according to The Register. This unprecedented volume includes at least two critical vulnerabilities that Redmond confirmed are already actively exploited in the wild. Industry analysts attribute the dramatic surge in tracked bugs to a combination of more aggressive automated code analysis, complex dependency chains in modern operating systems, and shifting internal development pipelines. For enterprise administrators, the sheer volume transforms routine maintenance windows into grueling triage exercises, forcing teams to automate deployment without sacrificing system stability.

• Microsoft deployed patches addressing 974 distinct CVEs in its September update cycle.
• The massive drop follows 421 security fixes in August and 622 patches issued in July.
• Two Microsoft vulnerabilities included in the September batch are already under active exploitation.
• Adobe issued 10 bulletins covering 172 CVEs, including a critical zero-day in Magento and Adobe Commerce.

How Is Adobe Responding to the Magento Zero-Day?

Adobe rushed emergency hotfixes to address an actively exploited zero-day vulnerability tracked as CVE-2026-75650, which security researchers named StyleSmuggler. Discovered by e-commerce security firm Sansec, the flaw allows unauthenticated remote attackers to execute arbitrary code by injecting malicious PHP payloads into Magento templates via style properties. Active exploitation began on September 4, targeting online shops running vulnerable versions of Magento and Adobe Commerce from 2.4.4 up to 2.4.9. Attackers leverage the flaw to install persistent backdoors connecting directly to external command-and-control infrastructure, making immediate patching the single highest priority for digital merchants.

"If your organization has any type of online shop, prioritize this one first as it’s already being abused to compromise stores."

What to watch next

Security teams should monitor three critical operational indicators over the coming weeks as organizations process these record-breaking updates. First, track how quickly enterprise automation tools successfully deploy the 974 Microsoft patches without triggering widespread blue screens or application regressions. Second, watch for secondary indicators of compromise on e-commerce servers running Magento and Adobe Commerce, specifically looking for unauthorized backend connections linked to the StyleSmuggler exploit. Third, observe whether upstream software vendors adjust their QA timelines to prevent future vulnerability pileups that overwhelm corporate security bandwidth.