Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

2026-09-08 | original

read original get YubiKey 5 NFC Security Key → more articles

Why This Matters

Microsoft's September 2026 Patch Tuesday is its largest ever, fixing 966 flaws including two actively exploited zero-days, on top of 204 cloud-side fixes issued earlier in the month. The surge follows Microsoft's adoption of an AI-powered vulnerability discovery system, which has driven patch volumes from 400 in August to nearly 1,000. For IT teams, the scale raises hard questions about triage, testing and patch fatigue.

Key Takeaways

966 flaws fixed, including 105 Critical (81 of them remote code execution) and two actively exploited zero-days.
AI-assisted vulnerability discovery is behind the sharp ramp-up: 570 fixes in July, 400 in August, now 966.
Admins should prioritize the zero-days and critical RCEs first; patch volume at this scale makes blanket testing impractical.

Worth a Look

YubiKey 5 NFC Security Key — With Patch Tuesday piling up hundreds of privilege-escalation and RCE fixes, hardware-backed sign-in is a smart layer of defense that patches alone can't provide. The YubiKey 5 NFC supports FIDO2/WebAuthn for Microsoft accounts, Entra ID, and Windows Hello, and taps to phones over NFC. Keep one on your keyring and a spare in a drawer.

See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.

Today is Microsoft's September 2026 Patch Tuesday, with security updates released for a record-breaking 966 flaws, including two actively exploited zero-day vulnerabilities.

This Patch Tuesday addresses 105 "Critical" vulnerabilities, 81 of which are remote code execution, 20 are elevation of privileges, 2 are information disclosure, and 1 security feature bypass.

The approximate number of bugs in each vulnerability category is listed below:

438 Elevation of Privilege Vulnerabilities

19 Security Feature Bypass Vulnerabilities

258 Remote Code Execution Vulnerabilities

173 Information Disclosure Vulnerabilities

56 Denial of Service Vulnerabilities

16 Spoofing Vulnerabilities

When BleepingComputer reports on Patch Tuesday security updates, we only count vulnerabilities released by Microsoft on Patch Tuesday itself.

... continue reading

Explore topics: microsoft patch tuesday zero-day remote code execution elevation of privilege