974 CVEs in One Month: Mapping the Windows Patch Surface With Internet-Wide Data
974 CVEs in One Month: Mapping the Windows Patch Surface With Internet-Wide Data
一个月内 974 个 CVE：利用全网数据绘制 Windows 补丁面
974 CVEs in One Month: Mapping the Windows Patch Surface With Internet-Wide Data. Microsoft’s September 2026 Patch Tuesday fixed 974 CVEs, including two exploited zero-days (CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in ALPC). Vulnerability management teams usually read such releases as internal work queues. Internet asset mapping adds a second, external view: which Windows-exposed services sit on public IPs, which of them leak version information, and how the patch backlog translates into a measurable external footprint.
一个月内 974 个 CVE：利用全网数据绘制 Windows 补丁面。微软 2026 年 9 月的“补丁星期二”修复了 974 个 CVE，其中包括两个已被利用的零日漏洞（Windows 更新堆栈中的 CVE-2026-81963 和 ALPC 中的 CVE-2026-85880）。漏洞管理团队通常将此类发布视为内部工作队列。而互联网资产测绘则提供了第二个外部视角：哪些暴露的 Windows 服务位于公网 IP 上，其中哪些泄露了版本信息，以及补丁积压如何转化为可衡量的外部攻击面。
From patch counts to external footprint: A Windows server missing September’s fixes does not advertise the fact, but the services it runs often do. RDP, SMB, IIS, Exchange OWA, and remote access components all expose version and configuration signals that mapping platforms index. The useful question for a team facing 974 fixes is not “how many CVEs affect us” but “which of our systems present an external face that maps onto the exploited or wormable subset.”
从补丁数量到外部攻击面：一台缺失 9 月补丁的 Windows 服务器不会主动宣告这一事实，但它运行的服务往往会。RDP、SMB、IIS、Exchange OWA 以及远程访问组件都会暴露版本和配置信号，而测绘平台会对这些信号进行索引。对于面临 974 个修复任务的团队来说，有意义的问题不是“有多少个 CVE 影响我们”，而是“我们的哪些系统呈现出与被利用或可蠕虫化漏洞子集相对应的外部接口”。
September’s release included 438 elevation-of-privilege issues, 257 remote code execution issues, and 20 wormable-class vulnerabilities. The EoP bugs mostly matter after a foothold exists. The RCE and wormable subset maps directly onto external exposure: an internet-reachable system running affected remote access components is a different risk object from an internal workstation with the same patch level.
9 月的发布包含 438 个权限提升漏洞、257 个远程代码执行漏洞以及 20 个可蠕虫化漏洞。权限提升（EoP）漏洞主要在攻击者获得立足点后才发挥作用。而远程代码执行（RCE）和可蠕虫化漏洞则直接映射到外部暴露面：一个运行受影响远程访问组件且可被互联网访问的系统，与补丁级别相同但处于内部的工作站，属于完全不同的风险对象。
Three mapping queries that operationalize the queue: Enumerate external RDP and remote access surfaces per organization or per ASN, so the exploited zero-day triage (both September zero-days are local, post-compromise bugs) gets paired with exposure triage of the remote-facing services where an RCE foothold starts. Index Exchange OWA and other webmail surfaces separately. The September bulletin included a Critical Exchange RCE triggered via a Visio file over email, and OWA instances visible from the internet are the population where that path opens first. Verify post-patch disappearance: after deployment, external banners and service versions shift, and mapping data can confirm the external footprint shrank, complementing internal patch compliance reports. Mapping platforms such as ZoomEye support these query patterns through product, service, and version fingerprints (https://www.zoomeye.org/).
三个可将队列操作化的测绘查询：按组织或 ASN 枚举外部 RDP 和远程访问接口，以便将零日漏洞分类（9 月的两个零日漏洞均为本地、入侵后的漏洞）与 RCE 立足点所在的远程服务暴露面分类相结合。单独索引 Exchange OWA 和其他 Webmail 接口。9 月的公告包含一个通过电子邮件中的 Visio 文件触发的关键 Exchange RCE 漏洞，而互联网可见的 OWA 实例正是该路径最先打开的目标群体。验证补丁后的消失情况：部署后，外部横幅和服务的版本会发生变化，测绘数据可以确认外部攻击面是否缩小，从而补充内部的补丁合规报告。诸如 ZoomEye 之类的测绘平台通过产品、服务和版本指纹支持这些查询模式 (https://www.zoomeye.org/)。
What mapping cannot do: External fingerprinting does not see patch levels behind firewalls, and version banners lag the underlying build in cloud and containerized deployments. The two zero-days are local privilege escalations, which mapping cannot detect at all; they require internal inventory. The honest division of labor: internal tools own patch state, mapping owns the external face, and the queue priority comes from joining the two.
测绘无法做到的事：外部指纹识别无法查看防火墙后的补丁级别，且在云和容器化部署中，版本横幅往往滞后于底层构建版本。那两个零日漏洞属于本地权限提升，测绘完全无法检测；它们需要通过内部资产清单来识别。诚实的分工是：内部工具负责补丁状态，测绘负责外部接口，而队列的优先级则源于将两者结合起来。
Limitations: This article synthesizes published September 2026 advisories and media reporting. No live mapping queries were executed for publication in this piece; the query channel was unavailable at writing time. Counts and CVE designations come from the cited sources.
局限性：本文综合了 2026 年 9 月已发布的公告和媒体报道。本文发布时未执行实时测绘查询；撰写时查询通道不可用。统计数据和 CVE 编号均来自引用的来源。
References: Microsoft MSRC September 2026 release notes (msrc.microsoft.com/update-guide/releaseNote/2026-Sep) FreeBuf coverage of the record Patch Tuesday, September 9, 2026 Huawei Cloud advisory summary, September 9, 2026
参考资料： 微软 MSRC 2026 年 9 月发布说明 (msrc.microsoft.com/update-guide/releaseNote/2026-Sep) FreeBuf 关于 2026 年 9 月 9 日创纪录“补丁星期二”的报道 华为云 2026 年 9 月 9 日公告摘要