966 vulnerabilities were patched in Microsoft's September 2026 Patch Tuesday — a record-breaking number that included two vulnerabilities the company says are being actively exploited.
Microsoft's September 2026 Patch Tuesday: the raw facts
Today is Microsoft's September 2026 Patch Tuesday. Security updates were released that address 966 distinct flaws, and the bulletin is described as "record-breaking" in scale. Among those fixes are two vulnerabilities Microsoft identifies as actively exploited zero-day issues.
Scale: what "record-breaking" tells us
The report characterizes this month's update as record-breaking because of the total count: 966 patched flaws. That single figure is the clearest datum available in the bulletin and signals a larger-than-usual volume of corrections bundled into this release. The use of the term "record-breaking" ties that figure to Microsoft's historical patch cadence without specifying which prior month or year held the previous record.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildActive exploitation: two zero-day vulnerabilities
Of the 966 patched issues, two are explicitly identified as zero-day vulnerabilities that are being actively exploited. The bulletin therefore separates a subset of immediate operational concern — the two actively exploited zero-days — from the broader set of flaws addressed in the release.
How technologists, affected enterprises, and end users are positioned
- Technologists and security teams: Faced with a record-sized bundle of 966 fixes, teams will be prioritizing the two actively exploited zero-days cited in the release while also triaging the remaining fixes for exposure and criticality.
- Affected enterprises and procurement leaders: The volume of updates in this release means patch management windows, testing cycles and deployment scheduling must account for a large set of changes arriving at once, with particular emphasis on the two flaws Microsoft reports as actively exploited.
- End users and the general public: The bulletin contains updates intended to remedy 966 flaws; the presence of two actively exploited zero-days underscores that some of those flaws were subject to real-world attack prior to patch availability.
Bottom line
Microsoft's September 2026 Patch Tuesday is notable for its scale — 966 fixes in a single monthly release — and for the inclusion of two zero-days Microsoft reports as actively exploited. Those two items anchor the release as an immediate operational concern, while the total count frames it as an unusually heavy maintenance moment for organizations relying on Microsoft software. The record figure and the presence of actively exploited zero-days are the concrete facts the bulletin supplies; how quickly organizations respond and how broadly the fixes are rolled out will determine the practical effect of this unusually large Patch Tuesday.
Source: BleepingComputer — Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
