TL;DR
what: Microsoft's September 2026 Patch Tuesday fixed 974 vulnerabilities, the largest single release ever, including two Windows privilege escalation flaws already exploited in the wild.
Microsoft shipped fixes for 974 vulnerabilities on September 8, 2026, the largest Patch Tuesday on record. Counting 25 non-Microsoft CVEs routed through the same update channel, the total reaches 999. Two of the 974 are already being exploited in the wild, and both are local privilege escalation bugs in Windows that end with the attacker holding SYSTEM. CISA added both to the Known Exploited Vulnerabilities catalog and set a remediation deadline for federal civilian agencies of September 22, 2026. The volume is a problem for your change calendar. The two zero-days are a problem for tonight.
Windows absorbed 723 of the fixes. Office and Office 2016 took 111, SQL Server 62, and developer tools 22. More than 110 carry a critical rating. Privilege escalation, remote code execution, and information disclosure account for close to 90 percent of the month. Counts vary by a few CVEs depending on the source, with Tenable putting the Microsoft total at 964, because vendors draw the boundary of what counts as a Microsoft CVE differently. The rank order of what you patch first does not change.
