Vulnerabilities
Microsoft Patch Tuesday 2026: 972 CVEs, 2 Exploited Zero‑Days, 113 Critical Vulnerabilities
Microsoft released updates for 972 CVEs on September 2026 Patch Tuesday, including two actively exploited zero‑days and 113 critical flaws. Defenders must prioritize patching Windows, Office, and Exchange, verify deployment, and monitor for exploitation attempts.
What Happened
On September 12, 2026 Microsoft issued security updates covering 972 CVEs. Two of these vulnerabilities were actively exploited in the wild, while 113 were rated critical. The advisory, MSRC‑2026‑09‑01, lists affected Windows, Office, and Exchange components.
Affected Systems
- Windows 10/11 – kernel, SMB, and Win32 API
- Microsoft Office 365 – Word, Excel, PowerPoint, Outlook
- Microsoft Exchange Server – web services and MAPI
- Azure AD and related cloud services – authentication flows
Immediate Actions
- Apply all available patches via WSUS, SCCM, Intune, or Azure Update Management.
- Verify successful deployment with the MSRC patch status tool.
- Block exploitation vectors using firewall rules (e.g., block SMBv1 traffic, disable legacy authentication protocols).
- Enable Microsoft Defender Advanced Threat Protection to detect anomalous activity.
Long‑Term Mitigation
Maintain a rolling patch cadence, keep systems updated to the latest cumulative update, and use endpoint detection and response to monitor for indicators of compromise. Regularly review the Microsoft Security Advisory feed for new CVEs and apply mitigations such as disabling vulnerable features or applying compensating controls.
Related vulnerabilities
Microsoft Patch Tuesday: 972 CVEs, 2 Exploited Zero-Days, 113 Critical Vulnerabilities
Microsoft released security updates for 972 CVEs in September 2026 Patch Tuesday, including two zero-days that were actively exploited and 113 critical flaws. Defenders should prioritize patching affected systems, validate deployment, and monitor for exploitation indicators.
Read briefing
Microsoft Patch Tuesday 2026: 972 CVEs, 113 Critical, 2 Exploited Zero‑Days
Microsoft released updates for 972 vulnerabilities in September 2026, including 113 critical flaws and two zero‑days that were actively exploited. Defenders must prioritize patching, verify deployment, and monitor for exploitation indicators.
Read briefing
Microsoft Unleashes 972 CVE Fixes on Patch Tuesday, Including 2 Exploited Zero‑Days and 113 Critical Flaws
Microsoft’s September 2026 Patch Tuesday update tackles 972 CVEs—two of which are actively exploited zero‑days and 113 critical vulnerabilities. The patch covers Windows, Office, and other Microsoft components, tightening defenses across the ecosystem. Security teams should apply the fixes immediately and monitor for any lingering exploitation attempts.
Read briefing
Microsoft Patch Tuesday 2026: 972 CVEs, 113 Critical, 2 Exploited Zero‑Days
Microsoft released security updates for 972 CVEs in September 2026, including 113 critical issues and two zero‑days that were actively exploited. Defenders must prioritize patching affected systems, validate deployment, and monitor for exploitation indicators.
Read briefing