Microsoft Fixed a Record 966 Flaws in September — Then Broke Backup, VPN and Audio

Microsoft's September Patch Tuesday fixed 966 vulnerabilities — a record — while breaking File History, Always On VPN, Remote Desktop and USB audio. An out-of-band fix on 14 September only partly helped; the rest waits for October.

Key Takeaways

Microsoft's September Patch Tuesday fixed 966 vulnerabilities — a record — while breaking File History, Always On VPN, Remote Desktop and USB audio.
An out-of-band fix on 14 September only partly helped; the rest waits for October.

AI synthesis5 sources4

Microsoft's September 2026 Patch Tuesday was the largest in the company's history by a wide margin: the monthly security release fixed 966 vulnerabilities, according to tallies of Microsoft's own advisory data, including two zero-days that were already being exploited. One breakdown counts 974 Microsoft CVEs, which would make it a record even against July's unusually heavy release.

Scale, in this case, was not a comfort. Within days of shipping, the September update was breaking things that had worked for years. Microsoft warned that File History — the long-standing backup feature that copies Desktop and Documents to an external drive — could stop functioning after the update, with users reporting a prompt to reconnect the drive. Microsoft also confirmed that the September security updates could break Always On VPN connections on some Windows 11 systems, and support threads documented failures in Remote Desktop, USB audio and Hyper-V.

On 14 September, Microsoft shipped an out-of-band cumulative update for Windows 11 versions 26H1, 25H2 and 24H2 to address the problems, as the company's Windows message center confirms. That did not close the matter: Windows Latest reported days later that the emergency update was itself still breaking audio on some PCs, and that a full fix was not expected before the October Patch Tuesday.

The episode is a useful counterweight to the assumption that AI-assisted development has made software safer by making it faster to produce. A record-volume security release is only as good as its regression testing, and the Windows servicing pipeline — pushing a single monthly change set to billions of machines — remains one of the hardest regression surfaces in commercial software.

For administrators the practical advice is unchanged and unglamorous: stage feature-affecting updates before fleet-wide rollout, verify that backup tooling actually runs after patching rather than merely being installed, and keep an out-of-band path ready. Two features that quietly do the heavy lifting in most organisations — file backup and remote access — were the ones this month's release damaged first.