Microsoft September 2026 Patch Tuesday fixes record 974 flaws, including two actively exploited Windows zero-days
Microsoft released updates for at least 974 vulnerabilities in Windows and other software, its largest Patch Tuesday ever. The previous record was 570 fixes in July. The 2026 total now exceeds 2,600, more than double the 2020 record year (1,245), with three months still to go. Microsoft and other large vendors, including Adobe, Cisco, Google, Mozilla and Oracle, credit AI-assisted vulnerability discovery for the rising patch volume. Security experts warn that organizations struggle to test and deploy fixes at this scale.
Detalhes técnicos
- Two zero-days are being actively exploited: CVE-2026-81963 and CVE-2026-85880. Both allow privilege escalation on Windows systems.
- 113 of the fixed bugs are rated "critical".
- CVE-2026-69730 is a critical DNS flaw affecting Windows Server 2012 onward and Windows 10. An unauthenticated attacker can exploit it with a specially crafted packet, and Microsoft rates exploitation as likely.
- CVE-2026-69829 is a critical remote code execution flaw in the Windows Shell. It has a CVSS score of 9.8 and is exploitable with low attack complexity, no privileges and no user interaction.
- Tenable's Satnam Narang notes that AI-assisted discovery is "creating larger haystacks" without finding more exploitable flaws, so risk-based prioritization matters.
Remediação
- Patch the two actively exploited zero-days first, then the DNS and Windows Shell critical flaws.
- Prioritize by reachability and exploitability in your own environment.
- Enterprises should test patches against third-party software before broad deployment, and consider after-hours rollouts.
- Home users should run Windows Update promptly and not let patches accumulate.
- The SANS Internet Storm Center publishes a per-patch breakdown by severity and urgency, and askwoody.com tracks problematic updates.
Linha do tempo
-
Microsoft September 2026 Patch Tuesday fixes record 974 flaws, including two actively exploited Windows zero-days
ler a análise desta fonte ocultar
Microsoft released updates for at least 974 vulnerabilities in Windows and other software, its largest Patch Tuesday ever. The previous record was 570 fixes in July. The 2026 total now exceeds 2,600, more than double the 2020 record year (1,245), with three months still to go. Microsoft and other large vendors, including Adobe, Cisco, Google, Mozilla and Oracle, credit AI-assisted vulnerability discovery for the rising patch volume. Security experts warn that organizations struggle to test and deploy fixes at this scale.
Technical Details
- Two zero-days are being actively exploited: CVE-2026-81963 and CVE-2026-85880. Both allow privilege escalation on Windows systems.
- 113 of the fixed bugs are rated "critical".
- CVE-2026-69730 is a critical DNS flaw affecting Windows Server 2012 onward and Windows 10. An unauthenticated attacker can exploit it with a specially crafted packet, and Microsoft rates exploitation as likely.
- CVE-2026-69829 is a critical remote code execution flaw in the Windows Shell. It has a CVSS score of 9.8 and is exploitable with low attack complexity, no privileges and no user interaction.
- Tenable's Satnam Narang notes that AI-assisted discovery is "creating larger haystacks" without finding more exploitable flaws, so risk-based prioritization matters.
Remediation
- Patch the two actively exploited zero-days first, then the DNS and Windows Shell critical flaws.
- Prioritize by reachability and exploitability in your own environment.
- Enterprises should test patches against third-party software before broad deployment, and consider after-hours rollouts.
- Home users should run Windows Update promptly and not let patches accumulate.
- The SANS Internet Storm Center publishes a per-patch breakdown by severity and urgency, and askwoody.com tracks problematic updates.