Advisories
Microsoft Patch Tuesday 2026: 972 CVEs Fixed, 113 Critical, 2 Exploited Zero‑Days Resolved
Microsoft’s September 2026 Patch Tuesday covered 972 vulnerabilities, including 113 critical flaws and two zero‑days that had already been weaponized. The rollout spans Windows, Office, and Azure services, tightening a broad attack surface. Security teams are urged to deploy the patches immediately, confirm coverage, and monitor for lingering exploitation attempts. CrowdStrike’s threat intel stresses the shrinking exploitation window and the need for continuous vigilance.
Microsoft’s September 2026 Patch Tuesday released a massive update that addressed 972 known vulnerabilities across its ecosystem. The patch set includes 113 critical flaws and two zero‑days that have already been leveraged by adversaries.
Patch Tuesday Highlights
- 972 total CVEs fixed
- 113 classified as critical severity
- 2 zero‑day vulnerabilities patched, both exploited in the wild
- Coverage spans Windows OS, Office suite, and Azure cloud services
Zero‑Day Exploits
Both zero‑day flaws were actively used by threat actors before Microsoft’s disclosure. The first involved a remote code execution vector in Windows kernel drivers, while the second exploited a privilege escalation path in a core Office component. Their rapid exploitation underscores the urgency of applying the latest updates.
Critical Vulnerabilities
The 113 critical CVEs affect a range of components, from core system libraries to cloud‑hosted applications. Many of these allow attackers to execute arbitrary code, bypass authentication, or exfiltrate data. The sheer breadth of affected products means that most organizations will need to review their patch management workflows.
Recommended Actions
- Apply all patches as soon as they are available, prioritizing the critical and zero‑day fixes.
- Run inventory scans to confirm that all affected systems are updated.
- Enable automatic updates where possible to reduce the window of exposure.
- Monitor network traffic for indicators of exploitation attempts, especially around the patched components.
- Leverage threat‑intel feeds to stay informed about new variants that may target the same CVEs.
"The exploitation window for these vulnerabilities is shrinking rapidly," said a CrowdStrike analyst. "Continuous monitoring and rapid response are now more critical than ever."
CrowdStrike Insight
CrowdStrike’s latest threat‑hunting reports confirm that attackers are capitalizing on the fastest‑moving zero‑days, using AI‑driven techniques to bypass traditional defenses. The company’s real‑time data classification and on‑device AI capabilities help security teams detect and contain attacks before they can fully exploit these flaws.
Related vulnerabilities
Microsoft Patch Tuesday 2026: 972 CVEs, 113 Critical, 2 Exploited Zero‑Days
Microsoft released security updates for 972 CVEs in September 2026, including 113 critical issues and two zero‑days that were actively exploited. Defenders must prioritize patching affected systems, validate deployment, and monitor for exploitation indicators.
Read briefing
Microsoft Unleashes 972 CVE Fixes on Patch Tuesday, Including 2 Exploited Zero‑Days and 113 Critical Flaws
Microsoft’s September 2026 Patch Tuesday update tackles 972 CVEs—two of which are actively exploited zero‑days and 113 critical vulnerabilities. The patch covers Windows, Office, and other Microsoft components, tightening defenses across the ecosystem. Security teams should apply the fixes immediately and monitor for any lingering exploitation attempts.
Read briefing
Microsoft Patch Tuesday: 972 CVEs, 2 Exploited Zero-Days, 113 Critical Vulnerabilities
Microsoft released security updates for 972 CVEs in September 2026 Patch Tuesday, including two zero-days that were actively exploited and 113 critical flaws. Defenders should prioritize patching affected systems, validate deployment, and monitor for exploitation indicators.
Read briefing
Microsoft Patch Tuesday 2026: 972 CVEs, 2 Exploited Zero‑Days, 113 Critical Vulnerabilities
Microsoft released updates for 972 CVEs on September 2026 Patch Tuesday, including two actively exploited zero‑days and 113 critical flaws. Defenders must prioritize patching Windows, Office, and Exchange, verify deployment, and monitor for exploitation attempts.
Read briefing