Microsoft’s September 2026 Patch Tuesday Closes Nearly a Thousand Flaws, Including Two Active Zero‑Days

Microsoft rolled out its September 2026 Patch Tuesday update on Tuesday, delivering fixes for 973 security vulnerabilities that span the company’s core operating system, productivity suites, cloud services and development tools. Among the patched issues are two zero‑day exploits that were actively leveraged in the wild, prompting urgent attention from security teams worldwide.

The bulk of the update targets Windows 10, Windows 11 and server editions, addressing privilege‑escalation paths, remote code execution bugs and information‑leak flaws. Microsoft Office applications, including the latest versions of Word, Excel and Outlook, also receive multiple patches that close attack surfaces used by macro‑based malware. Azure infrastructure components, Exchange Server, and a range of developer utilities such as Visual Studio and .NET runtimes are likewise covered, reflecting the breadth of the company’s software ecosystem.

The two zero‑day vulnerabilities, first disclosed by the security group GBHackers, were confirmed to be exploited in active campaigns before Microsoft issued the fix. While the advisory does not reveal technical details, the rapid response underscores the growing pressure on software vendors to remediate threats that attackers can weaponize before patches are released. Analysts note that the presence of exploited zero‑days in a routine Patch Tuesday highlights the accelerating pace of vulnerability discovery and exploitation.

Patch Tuesday, a long‑standing practice dating back to 2003, provides a predictable cadence for delivering security updates across Microsoft’s product line. Organizations rely on this schedule to plan remediation efforts and maintain compliance with industry regulations. However, the sheer volume of fixes in a single release can strain IT departments, especially when legacy systems and custom configurations require careful testing before deployment.

Microsoft recommends that users and administrators apply the September update as soon as possible, prioritizing systems that handle sensitive data or are exposed to the internet. The company also advises enabling automatic updates where feasible and reviewing the detailed security advisory for guidance on mitigating any residual risk. With the threat landscape continually evolving, the September rollout serves as a reminder that timely patching remains a critical defense against both known and emerging cyber threats.