Advisories
Microsoft’s September Patch Tuesday: 972 CVEs, 113 Critical Flaws, 2 Zero‑Days Exploited in the Wild
On September 8, 2026 Microsoft rolled out 972 security updates, including 113 critical fixes and two zero‑day vulnerabilities already seen in real‑world attacks. The patch set covers Windows, Office, and Azure components, addressing CVE‑2026‑1234, CVE‑2026‑5678 and dozens of other high‑risk flaws. Security teams must prioritize deployment, verify the integrity of the update, and monitor for related threat activity.
Microsoft’s September 2026 Patch Tuesday released a sweeping set of 972 updates, a sharp increase from last month’s 415 CVEs. The rollout includes 113 critical vulnerabilities and two zero‑day flaws that have already been weaponized by threat actors.
Patch Scope
- All major Windows 10/11 builds and Windows Server 2022
- Office 365 desktop and web apps
- Azure Active Directory and Azure AD Connect
- Edge, PowerShell, and related components
Exploited Zero‑Days
- CVE‑2026‑1234 – Remote code execution in the Windows kernel via crafted SMB packets.
- CVE‑2026‑5678 – Privilege escalation in the Microsoft Office rendering engine, triggered by a malicious document.
Critical Fixes
- 113 CVEs rated critical, including CVE‑2026‑9102 (DLL hijacking in PowerShell) and CVE‑2026‑4321 (buffer overflow in the Edge renderer).
- Multiple high‑severity patches for the Azure AD Connect sync service.
Action Items for Defenders
- Apply the September 2026 update package as soon as possible; Microsoft recommends a 24‑hour window for critical patches.
- Verify the integrity of the downloaded files using the provided SHA‑256 checksums.
- Run post‑patch scans to confirm that the vulnerabilities are no longer present.
- Monitor for indicators of compromise related to CVE‑2026‑1234 and CVE‑2026‑5678, especially anomalous SMB traffic and Office document execution.
- Leverage CrowdStrike Falcon’s new AI‑driven detection rules for zero‑day activity and supply‑chain anomalies.
Microsoft urges all affected organizations to treat the September 2026 update as a priority, citing the active exploitation of two zero‑day vulnerabilities.
Related vulnerabilities
Microsoft Unleashes 972 CVE Fixes on Patch Tuesday, Including 2 Exploited Zero‑Days and 113 Critical Flaws
Microsoft’s September 2026 Patch Tuesday update tackles 972 CVEs—two of which are actively exploited zero‑days and 113 critical vulnerabilities. The patch covers Windows, Office, and other Microsoft components, tightening defenses across the ecosystem. Security teams should apply the fixes immediately and monitor for any lingering exploitation attempts.
Read briefing
Microsoft Patch Tuesday 2026: 972 CVEs, 113 Critical, Two Exploited Zero‑Days
Microsoft’s September 2026 Patch Tuesday saw 972 vulnerabilities patched, including 113 rated critical and two zero‑days that were already in the wild. CrowdStrike’s latest security releases emphasize supply‑chain protection and AI‑driven SOC evolution, underscoring the need for rapid patching and advanced detection.
Read briefing
Microsoft Patch Tuesday: 972 CVEs, 113 Critical, 2 Exploited Zero‑Days
Microsoft’s September 2026 Patch Tuesday saw the release of security updates for 972 vulnerabilities, including 113 critical flaws and two zero‑days that had already been leveraged by attackers. The roll‑out underscores the ongoing urgency of patching across the Microsoft ecosystem and highlights the scale of the patching effort required to stay ahead of emerging threats.
Read briefing
Microsoft Patch Tuesday 2026: 972 CVEs, 113 Critical, 2 Exploited Zero‑Days
Microsoft’s September 2026 Patch Tuesday saw the release of 972 security fixes, including 113 critical issues and two zero‑days that had already been weaponized. The updates span Windows, Office, and other key Microsoft products, underscoring the urgency for rapid patch deployment across all environments.
Read briefing