Advisories
Microsoft September 2026 Patch Tuesday Fixes 972 Flaws, Including Two Actively Exploited Zero-Days
Microsoft's September 2026 Patch Tuesday updates address 972 vulnerabilities, including two zero-day flaws under active exploit and 113 critical-severity bugs. Security teams are urged to immediately prioritize patching affected enterprise systems.
September 2026 Patch Tuesday Overview
Microsoft has released its September 2026 Patch Tuesday security bulletin, delivering updates for a total of 972 vulnerabilities across its software suite. The massive update reflects an ongoing effort to mitigate severe risks before malicious actors can widely weaponize them.
Critical Flaws and Active Zero-Days
At the top of the remediation checklist are two zero-day vulnerabilities currently being exploited in live attacks. In addition to these zero-days, the update includes patches for 113 critical-rated flaws, many of which facilitate remote code execution and unauthorized privilege escalation across enterprise environments.
Defensive Guidance
Organizations are advised to prioritize emergency patching for high-impact systems to close exposure windows against emerging threats.
With threat actors continually automating exploit discovery, delaying patches significantly increases the probability of compromise. Security administrators should rapidly test and deploy these updates across network environments.
Related vulnerabilities
Microsoft Unleashes 972 CVE Fixes on Patch Tuesday, Including 2 Exploited Zero‑Days and 113 Critical Flaws
Microsoft’s September 2026 Patch Tuesday update tackles 972 CVEs—two of which are actively exploited zero‑days and 113 critical vulnerabilities. The patch covers Windows, Office, and other Microsoft components, tightening defenses across the ecosystem. Security teams should apply the fixes immediately and monitor for any lingering exploitation attempts.
Read briefing
Microsoft Patch Tuesday 2026: 972 CVEs, 113 Critical, 2 Exploited Zero‑Days
Microsoft’s September 2026 Patch Tuesday saw the release of 972 security fixes, including 113 critical issues and two zero‑days that had already been weaponized. The updates span Windows, Office, and other key Microsoft products, underscoring the urgency for rapid patch deployment across all environments.
Read briefing
Microsoft Patch Tuesday: 972 CVEs, 113 Critical, 2 Exploited Zero‑Days
Microsoft’s September 2026 Patch Tuesday saw the release of security updates for 972 vulnerabilities, including 113 critical flaws and two zero‑days that had already been leveraged by attackers. The roll‑out underscores the ongoing urgency of patching across the Microsoft ecosystem and highlights the scale of the patching effort required to stay ahead of emerging threats.
Read briefing
Microsoft's September 2026 Patch Tuesday: 972 CVEs, 113 Critical, 2 Exploited Zero‑Days
On Patch Tuesday, Microsoft pushed 972 security updates, including 113 critical flaws and two zero‑day vulnerabilities that were actively leveraged in the wild. The patches cover Windows, Office, and Azure services, addressing remote code execution, privilege escalation, and data exfiltration risks. Security teams must deploy the updates immediately, validate coverage, and monitor for any lingering exposure, especially in legacy or exposed environments.
Read briefing