September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs

Strategic summary

Microsoft patched 972 vulnerabilities in its September 2026 security update, more than double the number from August and a new Patch Tuesday record. The release includes fixes for two actively exploited zero-day vulnerabilities and 113 critical vulnerabilities. Risk is especially high in Microsoft Office, where 12 critical vulnerabilities can be exploited via the Preview Pane or Reading Pane without user interaction, as well as in unauthenticated RCE vulnerabilities across DNS, DHCP, MSMQ, NFS, and SSTP VPN. Additionally, a new proof-of-concept exploit called ShieldCrash targeting Microsoft Defender was disclosed.

Key findings

• 972 patched vulnerabilities in September 2026, double the August count and a new record for Patch Tuesday.
• Two actively exploited zero-day vulnerabilities and 113 critical vulnerabilities were addressed.
• 12 critical Microsoft Office vulnerabilities can be exploited via the Preview Pane or Reading Pane without any click or macro prompt.
• At least 17 CVEs cover unauthenticated remote code execution flaws in core infrastructure services including DNS, DHCP, MSMQ, NFS, and SSTP VPN.
• Critical remote code execution vulnerabilities in Netlogon and Kerberos threaten identity infrastructure and domain authentication.