Microsoft's September 2026 Patch Tuesday Addresses Record 974 Flaws, Including Two Actively Exploited Zero-Days

Microsoft has released its September 2026 Patch Tuesday update, addressing a record-breaking 974 vulnerabilities across its software ecosystem. This unprecedented number of fixes includes two flaws that Microsoft confirmed are being actively exploited in the wild, signaling immediate risk to unpatched systems.

The update covers a wide range of products: 723 vulnerabilities in Windows, 111 in Office and Office 2016, 62 in SQL Server, and 22 in Developer Tools. Of these, over 110 have been assigned a critical severity rating, indicating potential for remote code execution, privilege escalation, or data compromise.

The two actively exploited zero-days are of particular concern. While Microsoft has not disclosed specific technical details, the confirmation of in-the-wild exploitation means attackers are already leveraging these flaws. Organizations should treat these as top priority for immediate patching.

This record number of patches reflects the expanding attack surface of modern software. The sheer volume can be overwhelming for IT teams, but the presence of exploited zero-days elevates the urgency. Microsoft has released patches for all 974 vulnerabilities, and users are strongly advised to apply them promptly.

Given the scale, organizations should adopt a risk-based approach, prioritizing the two exploited zero-days and other critical flaws that could lead to remote code execution or privilege escalation. Regular patch management and vulnerability scanning are essential to mitigate exposure.