Microsoft September 2026 Patch Tuesday fixes nearly a thousand flaws, including two major zero-days Craig Hale | usagoldmines.com

• Microsoft has fixed no fewer than 974 vulnerabilities in its latest Patch Tuesday release
• Two were already being exploited in the wild, 114 categorized as ‘Critical’
• AI is to blame for boosting CVE discovery and also intensifying attacks

Microsoft’s September 2026 Patch Tuesday has become its biggest security release on record, with the company issuing fixes for a staggering 974 vulnerabilities across the entire stack.

According to the company’s release notes, an overwhelming majority (723) of the vulnerabilities addressed related to Windows, with Office coming in at second place with 111 of its own vulnerabilities being addressed.

While it’s clear that the number of vulnerabilities is going up year-over-year, it’s likely that the company was also simply able to find more of them that would otherwise have slipped through the net thanks to AI-assisted discovery tools.

This is Microsoft’s biggest Patch Tuesday ever

Speaking about the September 2026 Patch Tuesday in a blog post, Dustin Childs explains that this could be the start of the “new normal.” Childs goes on to reveal that Microsoft has patched 2,760 CVEs this year to date – more than double any other year that precedes it.

Childs’ figures show that the company patched 1,139 CVEs in the whole of 2025, and a much lower 492 a decade ago in 2016. According to the post, 114 of the vulnerabilities patched in this latest update were ‘Critical’ – more than one in 10.

In its own notes, Microsoft described CVE-2026-85880 and CVE-2026-81963 as especially notable because they’re both being actively exploited, hence the push to get them fixed and for customers to install the update.

Elsewhere in the industry, Microsoft isn’t the only company addressing a higher volume of bugs. Childs also highlighted high activity from Adobe, while a number of browser developers including Google, Mozilla, Brave and Microsoft itself have doubled the release cycle to two weeks in order to get fixes into customer hands more quickly.

Besides fixing exploitable bugs, Microsoft also used the opportunity to issue fixes to known issues – including fixing Teams and Outlook crashes on Arm64 PCs – as well as to upgrade Copilot+ AI components.