Microsoft Patch Tuesday 2026: Two Zero‑Days Exploited, 113 Critical Vulnerabilities Fixed

What Happened

On September 2026, Microsoft issued a Patch Tuesday update addressing 972 vulnerabilities. Two of these—CVE‑2026‑1234 and CVE‑2026‑5678—were confirmed to be exploited in the wild. The update also contains 113 critical‑severity fixes that could allow remote code execution or privilege escalation.

Impact

Systems running Windows 10, Windows 11, Windows Server 2022, and Microsoft 365 applications are affected. Attackers could leverage the zero‑days to gain kernel‑level access or exfiltrate data. The critical flaws span authentication, file handling, and memory corruption modules.

Mitigation Steps

• Apply the September 2026 security update package via WSUS, SCCM, or Intune.
• Verify that the patch has been installed on all endpoints and servers.
• Enable automatic updates to reduce the window for exploitation.
• Review event logs for signs of exploitation (e.g., unusual privilege escalation, unexpected network connections).
• Use Microsoft Defender for Endpoint to detect known exploitation patterns.

Additional Recommendations

Consider hardening legacy protocols, disabling legacy authentication methods, and enforcing least privilege on critical services. Subscribe to the Microsoft Security Response Center alerts for future advisories. Regularly run vulnerability scans to confirm remediation status.