Microsoft’s September 2026 Patch Tuesday fixes a record-breaking 974 security vulnerabilities across Windows, Office, and related software — the largest single-month patch bundle the company has ever shipped. It obliterates the previous record set just two months ago in July 2026 (570 fixes) and brings this year’s running total past 2,600, already more than double Microsoft’s prior record year of 2020 with three months still to go. Security experts credit AI-assisted vulnerability discovery with accelerating the pace, but warn that the sheer volume is straining teams responsible for testing and deploying updates before they break existing software.
Two zero-day flaws are being actively exploited in attacks right now: CVE-2026-81963 and CVE-2026-85880, both Windows privilege-escalation bugs that let an attacker who already has limited access gain full control of a machine. Of the 113 bugs rated Critical, two stand out. CVE-2026-69730 is a DNS weakness in Windows Server 2012 and later — and in Windows 10 — that lets an unauthenticated attacker seize a system just by sending a specially crafted network packet; Microsoft rates it as likely to be exploited. CVE-2026-69829 is a Windows Shell remote-code-execution flaw with a CVSS score of 9.8, requiring no user interaction and no attacker privileges to trigger.
How to check if you’re affected
Affected versions include all Windows 10 and Windows 11 devices, plus Windows Server 2012 and later releases. Open Settings → Windows Update and click Check for updates, then install everything available. If you manage Windows systems for an organization, prioritize CVE-2026-81963, CVE-2026-85880, CVE-2026-69730, and CVE-2026-69829 for emergency patching before the weekend.