The September 2026 Patch Tuesday Record: What 974 CVEs Means for Triage

Microsoft's September 2026 Patch Tuesday fixed 974 Microsoft CVEs, the largest single release on record. When a monthly update contains nearly a thousand entries, the practical problem stops being "should we patch" and becomes "in what order, and with what evidence."

The scale of the release

Of the 973 CVEs with published severity information, Microsoft rated 113 as Critical and 860 as Important. The company stated that 964 require customer action, with the remaining 9 resolved inside Microsoft's own cloud infrastructure. Microsoft also reissued 25 non-Microsoft CVEs in the same release.
The distribution by vulnerability class is consistent with recent trends. Elevation of privilege accounted for 438 entries, remote code execution for 258, information disclosure for 173, denial of service for 56, security feature bypass for 19, spoofing for 16 and tampering for 13.

The two exploited zero-days

Two vulnerabilities in the release were already being exploited:

• CVE-2026-85880, in the Windows Advanced Local Procedure Call component, is an elevation of privilege flaw.
• CVE-2026-81963, in the Windows Update Stack, is also an elevation of privilege flaw, involving symbolic link following. Both are rated Important rather than Critical. That rating is the most useful detail in the release, because it demonstrates why severity labels alone are a poor triage signal. A flaw that is already being exploited in the wild poses more immediate risk than a higher-rated flaw with no observed exploitation.

Why the count is so large

A release of this size is not simply the result of more vulnerabilities existing. Researchers have noted that automated auditing tools are contributing to the volume of findings. When analysis is partly automated, more issues are identified and reported per unit of engineering time, which increases the number of items entering the release pipeline.
For defenders, this changes the shape of the problem. A larger release does not necessarily mean a more dangerous month, but it does mean a larger triage workload. The filtering step becomes the bottleneck.

Triage that reflects actual risk

The reported guidance is risk-based staged deployment rather than uniform application. Four factors drive the ordering:

1. Active exploitation status. The two zero-days belong at the front regardless of their severity rating.
2. Exposure. A flaw in a service reachable from the internet carries more risk than the same flaw in a component only reachable from an internal network.
3. Business criticality. A system whose unavailability halts operations warrants earlier attention than a test environment.
4. System role. A host that other systems trust, such as a certificate authority or a management server, has a larger blast radius if compromised. ZDI researchers noted that at least 20 of the September fixes could be classified as wormable, meaning they combine pre-authentication access, zero interaction and remote code execution. Those are the entries that justify attention to internet-facing services before internal ones.

Notable individual entries

Beyond the two zero-days, the release addressed several issues worth flagging for their reach:

• CVE-2026-55007, in Exchange Server, is a pre-authentication remote code execution flaw triggered through an email containing a malicious Visio attachment.
• CVE-2026-69380, also in Exchange Server, is a privilege escalation flaw that allows reading and sending across mailboxes.
• CVE-2026-69676, in Windows Kerberos, is an authentication bypass combined with capture and replay.
• CVE-2026-69465, in SharePoint, is a remote code execution flaw reachable by an authenticated user.
• CVE-2026-65669, in SQL Server, is an elevation of privilege flaw that requires inducing a SQL Copilot user to supply input. The Exchange entries deserve particular attention because Exchange has been a persistent target. Since November 2021, CISA has added 20 Exchange vulnerabilities to its Known Exploited Vulnerabilities catalog, 14 of which were associated with ransomware activity.

A practical ordering

For an environment facing this release, a defensible sequence is:

1. Apply the two confirmed exploited zero-days first, and prioritize systems where the affected components are exposed.
2. Address the wormable-class flaws on internet-facing services next.
3. Handle the Exchange and SharePoint entries, since both products have a history of being targeted and both have broad reach.
4. Work through the remaining Critical entries by exposure and business criticality.
5. Schedule the Important entries that are not exploited and not internet-facing into the normal maintenance cycle. The exact ordering will differ by environment. The principle is that exploitation status and reachability should outweigh the severity label.

What the release does not tell you

A patch count does not indicate how many of the fixed flaws were reachable in any particular environment. Most of the 974 entries will not apply to a given organization, because the affected component is not installed, not exposed, or not in use. The release notes describe what was fixed, not what is at risk.
The two zero-days are the exception. They are confirmed as exploited, which removes the question of whether an attacker would use them.

References

• Microsoft September 2026 Security Updates release notes
• CISA Known Exploited Vulnerabilities catalog
• ZDI analysis of the September 2026 release
• Splashtop summary of the September 2026 Patch Tuesday, 8 September 2026