Patch Tuesday September 2026: what's exploited and what to install first
Microsoft released fixes for 972 vulnerabilities on Sep 8, 2026. 2 are already being exploited by attackers, so install those fixes first. 113 are rated Critical.
Install these first: already exploited
- Windows Update StackExploitedImportantCVSS 7.8Microsoft Windows Link Following Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
- Windows ALPCExploitedImportantCVSS 7.8Microsoft Windows Heap-Based Buffer Overflow Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
Critical fixes
- CVSS 10.0 Azure AI Language Elevation of Privilege Vulnerability
- CVSS 10.0 Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
- CVSS 9.9 Entra ID Elevation of Privilege Vulnerability
- CVSS 9.8 Skype for Business Remote Code Execution Vulnerability
- CVSS 9.8 Microsoft SQL Server Remote Code Execution Vulnerability
- CVSS 9.8 Microsoft SQL Server Remote Code Execution Vulnerability
- CVSS 9.8 Windows Message Queuing Remote Code Execution Vulnerability
- CVSS 9.8 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
- CVSS 9.8 Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
- CVSS 9.8 Windows DNS Server Remote Code Execution Vulnerability
- CVSS 9.8 Windows HTTP Print Provider Remote Code Execution Vulnerability
- CVSS 9.8 Windows Shell Remote Code Execution Vulnerability
How to install this month's updates
- Windows PCs: Settings → Windows Update → Check for updates, install, and restart. Restarting is what actually applies the fix.
- Managed fleets: approve this month's updates in Intune, Windows Update for Business or WSUS, and push the exploited fixes first instead of waiting for your normal ring schedule.
- Microsoft 365 Apps / Office: usually updates itself; in any Office app, File → Account → Update Options → Update Now to make sure.
- Servers: Exchange, SharePoint and SQL Server need their own update packages; they don't come through Windows Update alone.
- Check it worked: confirm the build number afterwards (run
winver) or check with our version checker.
By type
| Type | Fixes |
|---|---|
| Elevation of Privilege | 438 |
| Remote Code Execution | 258 |
| Information Disclosure | 173 |
| Denial of Service | 55 |
| Security Feature Bypass | 19 |
| Spoofing | 16 |
| Tampering | 13 |
Most-patched products
| Product | Fixes |
|---|---|
| Windows Biometric Service | 64 |
| SQL Server | 61 |
| Microsoft Office Word | 36 |
| Windows DHCP Server | 36 |
| Microsoft Office Excel | 32 |
| Windows NTFS | 29 |
| Windows Win32K | 23 |
| Microsoft Standard XPS | 18 |
The next Patch Tuesday is Nov 10, 2026 (in 5 days). Microsoft usually publishes around 10 a.m. Pacific; this page updates within the hour.
Questions
What should I patch first from Patch Tuesday September 2026?
The 2 exploited flaws: Windows Update Stack Elevation of Privilege Vulnerability; Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability. Attackers are already using them.
When is the next Patch Tuesday?
Nov 10, 2026. Microsoft releases security updates on the second Tuesday of every month.
Source: Microsoft's September 2026 release notes and CISA's exploited-vulnerability catalog. Counts exclude Chromium fixes shipped in Microsoft Edge. Microsoft last revised this release on Nov 4, 2026. General information only; confirm details with Microsoft.