974 CVEs in One Month: Mapping the Windows Patch Surface With Internet-Wide Data Microsoft's September 2026 Patch Tuesday fixed 974 CVEs, including two exploited zero-days (CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in ALPC). Vulnerability management teams usually read such releases as internal work queues. Internet asset mapping adds a second, external view: which Windows-exposed services sit on public IPs, which of them leak version information, and how the patch backlog...