Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs
Brief
September 2026 Patch Tuesday fixes a record 974 CVEs including 2 exploited zero-days, 20 wormable bugs, and a critical Exchange RCE via Visio email.
Microsoft’s September 2026 Patch Tuesday set a new record. Depending on how researchers count external and Chromium bugs, Microsoft fixed between 966 and 997 CVEs in this update. The company also fixed another 204 vulnerabilities earlier in September across Azure, Entra ID, Edge, and other services. This means the total number of September fixes is already much higher than the headline figure.
“It’s a new record release from Microsoft, but, again, that seems to be the new normal. As always, counting this beast is tricky, but I see 972 new CVEs rolling out from Redmond this month.” reads the report published by ZDI. “On the one hand, congrats to the security gnomes at Microsoft for being able to patch bugs at this rate.