Microsoft September 2026 Patch Tuesday Addresses Record 974 Vulnerabilities

What Happened

Microsoft has issued its largest security update ever for September 2026, delivering patches for 974 distinct vulnerabilities across its product ecosystem. The release includes 113 critical-severity and 860 important-severity flaws, alongside two vulnerabilities confirmed to be under active exploitation in the wild. Notably, the update covers core infrastructure and developer tooling such as Windows HTTP.sys, Windows Hyper-V, Exchange Server, Entra ID, GitHub Copilot, and Visual Studio Code. Concurrently, Adobe published nine advisories addressing 170 vulnerabilities.

Vulnerability Breakdown

The vast volume of patches spans multiple vulnerability classes, heavily weighted toward elevation of privilege and remote code execution vectors:

• Elevation of Privilege: 438 flaws (27 critical, 411 important)
• Remote Code Execution: 253 flaws (82 critical, 171 important)
• Information Disclosure: 173 flaws (2 critical, 171 important)
• Denial of Service: 56 flaws (56 important)
• Security Feature Bypass: 19 flaws (1 critical, 18 important)
• Spoofing: 16 flaws (1 critical, 15 important)

Impact

Due to the massive scope of the update—surpassing recent months which averaged 400 to 570 fixes—organizations face a high operational burden to maintain patch hygiene. Unpatched systems remain exposed to potential remote code execution, privilege escalation, and denial-of-service vectors, compounded by the presence of active exploitation vectors in the wild. Edge (Chromium-based) is notably absent from this month's Microsoft advisories.

What to Do

SecOps and sysadmins should immediately ingest vulnerability telemetry, prioritize endpoints running exposed services like Hyper-V and Exchange Server, and expedite patch deployment to mitigate zero-day risk.

• Run internal vulnerability scans using authenticated agents to map affected hosts against the September 2026 dataset.
• Prioritize remediation for the two actively exploited flaws and the 113 critical-severity CVEs.
• Review Adobe advisories and schedule corresponding application updates to address the 170 newly disclosed third-party vulnerabilities.