Our takeMicrosoft's September 2026 Patch Tuesday fixes a record 973 vulnerabilities, including two actively exploited zero-days. Patch today.Cyber Resilience desk
Sources (4)
- therecord · therecord
- cyberscoop · cyberscoop
- acsm_au · acsm_au
- securityweek · securityweek
What this means for you — Security leader:Apply Microsoft's September 2026 patches (974 CVEs, two exploited in the wild) prioritizing the two KEV-listed zero-days. Test and deploy in your standard cycle; most impact is limited to specific components.
What this means for you — Lean IT orgs:Microsoft released fixes for nearly 1,000 bugs this month, including two that attackers are already using. Update Windows and Office on your computers as soon as you can.
What this means for you — MSP:Patch all customer estates for Microsoft's September 2026 release (974 CVEs). Prioritize the two CISA KEV zero-days; schedule the rest by risk and exposure per client stack.
What this means for you — Researcher:Microsoft's September 2026 Patch Tuesday covers 974 vulnerabilities including two exploited zero-days now in CISA KEV. Review the full release notes for new attack surface details.