September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs

Microsoft has addressed 972 vulnerabilities in its September 2026 security update release, over double the number of CVEs released in August, and a new Patch Tuesday record. This month's patches include fixes for two exploited zero-day vulnerabilities and 113 Critical vulnerabilities, along with 857 additional vulnerabilities of varying severity levels. Additionally, there was a new proof-of-concept zero-day exploit disclosed against Microsoft Defender, dubbed ShieldCrash. This is discussed at the end of this blog, separately from Microsoft’s patches. With CrowdStrike Falcon® Exposure Management, you can automatically classify and prioritize assets, show attack paths targeting client-side exploitation of devices, and integrate with CrowdStrike Falcon® Next-Gen SIEM. Learn more in this blog post: This month's leading risk types by exploitation technique are elevation of privilege with 437 patches (45%), remote code execution (RCE) with 258 patches (26%), and information disclosure with 171 (18%). Microsoft Windows received the most patches this month with 726, followed by Extended Security Updates (ESU) with 650, and Microsoft Office with 135. Microsoft Office received 22 Critical patches this month, of which 12 are exploitable via Preview Pane or Reading Pane. When Preview Pane or Reading Pane is enabled, merely previewing a crafted file triggers code execution without any…