Vulnerabilities
Microsoft September 2026 Patch Tuesday: 2 Exploited Zero‑Days, 113 Critical Vulnerabilities
Microsoft released security updates for 972 CVEs, including two zero‑day exploits that were actively used and 113 critical flaws. The update covers Windows 10/11, Office, Exchange, and Azure services. Defenders should apply patches immediately, verify deployment, and monitor for exploitation attempts.
What happened
Microsoft issued a Patch Tuesday update on September 15, 2026 that addressed 972 vulnerabilities. Two of those were zero‑day exploits that had already been leveraged in the wild, and 113 were rated critical.
Impact
All Windows 10 and 11 endpoints, Office 365, Exchange Server, and Azure cloud services are affected. Attackers could gain remote code execution, privilege escalation, or data exfiltration if the flaws remain unpatched.
Affected products
- Windows 10/11 (all editions)
- Microsoft Office 365 (desktop and web)
- Exchange Server 2016/2019/2023
- Azure Active Directory, Azure Storage, Azure Functions
What to do
- Download and install the September 2026 updates from Microsoft Update or WSUS immediately.
- Verify that the patches are applied by checking the installed update list or using PowerShell scripts.
- Run vulnerability scanners to confirm remediation of the 972 CVEs.
- Enable real‑time monitoring for exploitation signatures related to the two zero‑days.
- Apply any additional mitigations (e.g., disabling legacy protocols, enforcing MFA) as recommended in the advisory.
Related vulnerabilities
Microsoft Patch Tuesday 2026: 972 CVEs, 113 Critical, 2 Exploited Zero‑Days
Microsoft released updates for 972 vulnerabilities in September 2026, including 113 critical flaws and two zero‑days that were actively exploited. Defenders must prioritize patching, verify deployment, and monitor for exploitation indicators.
Read briefing
Microsoft Patch Tuesday 2026: 972 CVEs, 2 Exploited Zero‑Days, 113 Critical Vulnerabilities
Microsoft released updates for 972 CVEs on September 2026 Patch Tuesday, including two actively exploited zero‑days and 113 critical flaws. Defenders must prioritize patching Windows, Office, and Exchange, verify deployment, and monitor for exploitation attempts.
Read briefing
Microsoft Patch Tuesday 2026: 972 CVEs, 113 Critical, 2 Exploited Zero‑Days
Microsoft released its September 2026 Patch Tuesday update, addressing 972 vulnerabilities, including 113 critical and two zero‑days that had already been exploited in the wild. The update covers Windows and Office components, requiring immediate patching to mitigate active threats. Defenders should prioritize applying the patches, verify installation, and monitor for exploitation activity.
Read briefing
Microsoft Patch Tuesday: 972 CVEs, 2 Exploited Zero-Days, 113 Critical Vulnerabilities
Microsoft released security updates for 972 CVEs in September 2026 Patch Tuesday, including two zero-days that were actively exploited and 113 critical flaws. Defenders should prioritize patching affected systems, validate deployment, and monitor for exploitation indicators.
Read briefing