Patch and vulnerability tracker / Microsoft Patch Tuesday

Microsoft Patch Tuesday September 2026: every CVE and patch, ranked by risk

The front page of Microsoft patching: every CVE and the update (KB) that fixes it, the day it ships. September 2026 shipped 60 updates fixing 1,169 CVEs, 118 of them Critical Severity and 2 already confirmed exploited in the wild. Senserva holds 27 months of releases this way, every month measured the same, so a spike is visible rather than asserted.

Zero-days are called out by name, and each release is ranked by what attackers actually exploit. Every KB links its own page with the download, the known issues Microsoft documents, a PowerShell installed-check, and the newer package that supersedes it when one has shipped. Patch Tuesday trends, the full history, calendar, and feeds live here, alongside the voices of the other Patch Tuesday trackers we follow.

Next Patch Tuesday: October 13, 2026, in 31 days.

Data refreshed once a day, early morning US Central.

Senserva is a Microsoft Intelligent Security Association memberOpen the full patch tracker

This Patch TuesdayELEVATEDbecause 2 CVEs are already being exploited in the wildNext: October 13, 2026 (31 days)

September 2026 at a glance

Microsoft shipped 60 updates fixing 1,169 CVEs this release.
60
Updates (KBs)
1,169
CVEs fixed
2
Exploited zero-day, new this release
2
On the CISA KEV list
0
Ransomware-linked
118
Critical, rated by Microsoft

Figures are Microsoft's own, from MSRC CVRF 2026-Sep, read on 2026-09-08. Microsoft's Severity split covers 1,146 of the 1,169; 23 carry no rating. Senserva tracks 914 of them against update articles we hold pages for; the difference is largely Azure Linux entries that ship no KB article.

See the historySubscribe (RSS)

The Senserva AI read pre-beta

This month is not routine. Two zero-days are already being exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call. Both are elevation of privilege issues (CVSS 7.8) and both are also on the CISA KEV catalog, so patch these two first, everywhere Windows runs, before anything else on the list. Microsoft's official count for September 2026 is 1169 CVEs fixed across 60 KBs, with 118 rated Critical. After the zero-days, prioritize Critical fixes touching .NET 10.0, 8.0, and 9.0 on Windows, and Office/Microsoft 365 Apps for Enterprise, since these show the highest per-product patch counts this month.

Against the trailing 12-month averages, this release runs well above normal: 1169 CVEs fixed versus an average of 156, 118 Critical versus 17, and 2 actively exploited zero-days matching the recent monthly average rather than exceeding it. That the exploited count sits at the average, not above it, does not make this a light month. Volume and Critical severity are both elevated, so treat September as a high-effort patching cycle: patch the two exploited zero-days immediately, then work through Critical items on a normal timeline.

Pre-beta. Generated by Senserva AI from the live release data on this page, 2026-09-10. Regenerated when the data changes. The human take is above.
Take this release to your AI

Composed from the live September 2026 release data above, refreshed once a day (early morning US Central). Copy it into Claude, ChatGPT, or Copilot. Free, no sign-in.

What those we follow are saying

Verbatim headlines from the trusted Patch Tuesday sources, pulled live from their own feeds (as of 2026-09-12). Items that name a CVE are also linked from that CVE's row above. For our own opinion, read the Senserva take on the blog.

“BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days”Multiple espionage-motivated threat actors have adopted BlueMoon in opportunistic, rushed deployments.SecurityWeek, 2026-09-12
“Check Point Patches Critical VPN Vulnerabilities”Tracked as CVE-2026-85102 and CVE-2026-85103, the flaws could be exploited for remote code execution.SecurityWeek, 2026-09-11 · CVE-2026-85102, CVE-2026-85103
“GitLab Vulnerability Exploited One Day After Disclosure”The critical-severity path traversal flaw allows unauthenticated attackers to read arbitrary files from the GitLab server.SecurityWeek, 2026-09-11
“Microsoft sees some new wrinkles in invoice-scam emails”Researchers analyzed a flood of fraudulent business emails and found that the threat actors had doubled-up on tactics to make them appear legitimate, including help from AI.The Record, 2026-09-11
“AI agents exploited PaperCut flaws to breach 395 organizations”A threat actor built a working exploit for PaperCut print management software, then handed the job of breaking into hundreds of organizations to AI agents that did most of the work on their own, according to GreyNoise.Help Net Security, 2026-09-11
“Microsoft fixes Teams, Outlook launch failures on ARM Windows PCs”Microsoft has fixed a bug that prevented Teams and Outlook from launching on ARM-based Windows devices after installing updates released since the August 2026 Patch Tuesday.BleepingComputer, 2026-09-11
“GitLab urges users to patch max severity path traversal flaw”GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706.BleepingComputer, 2026-09-11 · CVE-2026-85706
“Passkey-themed phishing attacks lead to Microsoft 365 data theft”Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single sign-on-themed social engineering attacks to compromise corporate Microsoft accounts and steal data from…BleepingComputer, 2026-09-11
“Metasploit Wrap Up: This One Goes to Sixteen!”This One Goes to Sixteen! Another banger from Metasploit with sixteen new modules, including ten exploit modules, with five on the CISA KEV list.Rapid7, 2026-09-11 · CVE-2025-66516, CVE-2025-54988, CVE-2026-20929, CVE-2026-20079
“Detect and disrupt AI-themed attacks with Microsoft Defender”See how Microsoft Defender detects and disrupts AI-themed phishing, malware, and multi-stage attacks across the attack chain.Microsoft Security Blog, 2026-09-10
“Protecting organizations from AI-assisted executive impersonation and invoice fraud”Microsoft examines an AI-assisted business email compromise campaign that used executive impersonation and fake invoices to target finance teams with ACH payment fraud.Microsoft Security Blog, 2026-09-10
“Nightmare-Eclipse Strikes Again With 'ShieldCrash' Windows Exploit”The disgruntled researcher continued their vendetta against Microsoft by publishing yet another zero-day exploit for Windows Defender.Dark Reading, 2026-09-10
“Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data”Threat actors are leveraging Microsoft's Graph API to identify lucrative targets, then passing their access to extortion groups like ShinyHunters.Dark Reading, 2026-09-10
“Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers”Cisco Talos says two recently patched Secure Firewall Management Center (FMC) vulnerabilities have been exploited by three separate threat clusters linked to ransomware and state-sponsored attacks.BleepingComputer, 2026-09-10

Critical is rarer, and bigger

Every Microsoft update we track, grouped by the severity Microsoft assigned it, across 1,085 updates and 3,969 distinct CVEs (as of 2026-09-11). The count is UPDATES, not CVE fixes, and the difference matters: Important updates outnumber Critical ones, but a Critical update carries several times as many CVE fixes, because it is usually a cumulative one. So a Critical month is not just more urgent, it is a wider deployment. Counts per update are under each bar. The bars add up to 1,102 rather than 1,085 because 17 updates were rated at more than one severity.

Important779

9,942 CVE fixes, 12.8 per update

Critical253

22,492 CVE fixes, 88.9 per update

Moderate70

83 CVE fixes, 1.2 per update

Actively exploited this release

These are the September 2026 CVEs already being exploited in the wild, flagged by Microsoft in its release document or listed on CISA KEV. Patch them first, everywhere.

CVE-2026-81963HighWindows Update Stack Elevation of Privilege VulnerabilityCVSS 7.8

An Elevation of Privilege vulnerability affecting Windows Server 2025 (Server Core installation).

Affects: Windows Server 2025 (Server Core installation), Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems

More on CVE-2026-81963 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

Covering this CVE: Rapid7 · Tenable · Zero Day Initiative

CVE-2026-85880HighWindows Advanced Local Procedure Call (ALPC) Elevation of Privilege VulnerabilityCVSS 7.8

An Elevation of Privilege vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-85880 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

Covering this CVE: Rapid7 · Tenable · Zero Day Initiative

Highest-risk fixes this release

Not yet flagged as exploited, but critical-severity (CVSS 8.8+) and worth prioritizing.

CVE-2026-68839CriticalWindows USB Mass Storage Class Driver Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-68839 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69276CriticalMicrosoft UxTheme Library (uxtheme.dll) Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69276 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69408CriticalMicrosoft Windows Media Foundation Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69408 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69431CriticalTelnet Client Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69431 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69463CriticalWindows NTFS Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69463 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69491CriticalMicrosoft DirectMusic Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69491 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69493CriticalWindows Event Logging Service Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69493 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69496CriticalWindows Compressed Folder Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69496 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69525CriticalRemote Desktop Services Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69525 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

Covering this CVE: Tenable · Zero Day Initiative

CVE-2026-69579CriticalWindows Message Queuing Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69579 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

Covering this CVE: Zero Day Initiative

CVE-2026-69586CriticalMicrosoft Windows PDF Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69586 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69590CriticalWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69590 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

September 2026 breakdown

What Microsoft fixed this release, by impact type and by product. Expand any row for what it means and the CVEs behind it, each linked to its full page.

By impact type

Elevation of Privilege426

The attacker gains higher permissions than they were granted, for example from a standard user to administrator or SYSTEM. These are the workhorses of exploit chains.

426 CVEs this release, highest CVSS first:

CVE-2026-69641 9.1CVE-2026-73012 8.8CVE-2026-80096 8.8CVE-2026-83996 8.8CVE-2026-69784 8.8CVE-2026-69740 8.8CVE-2026-69439 8.8CVE-2026-47295 8.8CVE-2026-55002 8.8CVE-2026-66814 8.8CVE-2026-66818 8.8CVE-2026-66819 8.8CVE-2026-66820 8.8CVE-2026-67368 8.8CVE-2026-67370 8.8CVE-2026-67381 8.8CVE-2026-73028 8.8CVE-2026-77480 8.8CVE-2026-77483 8.8CVE-2026-77487 8.8CVE-2026-69464 8.8CVE-2026-69716 8.8CVE-2026-77503 8.4CVE-2026-69846 8.2+402 more

Remote Code Execution241

The attacker runs their own code on the target, usually the most serious class of vulnerability. Prioritize internet-facing and unpatched systems first.

241 CVEs this release, highest CVSS first:

CVE-2026-68839 9.8CVE-2026-69276 9.8CVE-2026-69408 9.8CVE-2026-69431 9.8CVE-2026-69463 9.8CVE-2026-69491 9.8CVE-2026-69493 9.8CVE-2026-69496 9.8CVE-2026-69525 9.8CVE-2026-69579 9.8CVE-2026-69586 9.8CVE-2026-69590 9.8CVE-2026-69595 9.8CVE-2026-69715 9.8CVE-2026-69730 9.8CVE-2026-69768 9.8CVE-2026-69769 9.8CVE-2026-69819 9.8CVE-2026-69824 9.8CVE-2026-69829 9.8CVE-2026-69845 9.8CVE-2026-69910 9.8CVE-2026-70296 9.8CVE-2026-72979 9.8+217 more

Information Disclosure148

The flaw leaks data that should be protected, such as memory contents, file data, or authentication tokens. Leaked credentials often feed the next stage of an attack.

148 CVEs this release, highest CVSS first:

CVE-2026-69443 7.5CVE-2026-70587 7.5CVE-2026-71330 7.5CVE-2026-72932 7.5CVE-2026-72989 7.5CVE-2026-70579 7.5CVE-2026-66304 7.5CVE-2026-69267 6.5CVE-2026-69297 6.5CVE-2026-69395 6.5CVE-2026-72942 6.5CVE-2026-78453 6.5CVE-2026-70019 6.5CVE-2026-58649 6.5CVE-2026-50468 6.5CVE-2026-54116 6.5CVE-2026-67386 6.5CVE-2026-67390 6.5CVE-2026-67393 6.5CVE-2026-67624 6.5CVE-2026-67629 6.5CVE-2026-67630 6.5CVE-2026-67645 6.5CVE-2026-67648 6.5+124 more

Denial of Service52

The attacker crashes or hangs a service, taking it offline. Lower confidentiality impact, but a real availability risk for exposed services.

52 CVEs this release, highest CVSS first:

CVE-2026-68887 7.5CVE-2026-69329 7.5CVE-2026-69342 7.5CVE-2026-69428 7.5CVE-2026-69631 7.5CVE-2026-69760 7.5CVE-2026-69881 7.5CVE-2026-70065 7.5CVE-2026-77494 7.5CVE-2026-77498 7.5CVE-2026-77499 7.5CVE-2026-77501 7.5CVE-2026-77502 7.5CVE-2026-77886 7.5CVE-2026-77888 7.5CVE-2026-77889 7.5CVE-2026-77890 7.5CVE-2026-77893 7.5CVE-2026-77895 7.5CVE-2026-83989 7.5CVE-2026-84001 7.5CVE-2026-69587 7.5CVE-2026-69588 7.5CVE-2026-69809 7.5+28 more

Other27

Other or uncategorized impact types in this release.

27 CVEs this release, highest CVSS first:

CVE-2026-68891CVE-2026-69316CVE-2026-69381CVE-2026-69474CVE-2026-69483CVE-2026-69548CVE-2026-69713CVE-2026-69792CVE-2026-69853CVE-2026-69895CVE-2026-72931CVE-2026-72980CVE-2026-73019CVE-2026-78446CVE-2026-78452CVE-2026-78455CVE-2026-78508CVE-2026-78516CVE-2026-68849CVE-2026-70575CVE-2026-69425CVE-2026-69771CVE-2026-68785CVE-2026-72976+3 more

Spoofing12

The attacker impersonates a user, system, or piece of content to trick a victim. Common in phishing and man-in-the-middle scenarios.

12 CVEs this release, highest CVSS first:

CVE-2026-69356 9.3CVE-2026-69646 8.3CVE-2026-69680 8.1CVE-2026-70563 8.1CVE-2026-62759 7.5CVE-2026-69402 7.3CVE-2026-69417 7.3CVE-2026-66305 7.1CVE-2026-69361 6.5CVE-2026-64918 6.5CVE-2026-63523 6.5CVE-2026-69642 6.5

Tampering11

The attacker modifies data or code without authorization, undermining the integrity of the system.

11 CVEs this release, highest CVSS first:

CVE-2026-69482 7.1CVE-2026-69624 6.5CVE-2026-69375 6.5CVE-2026-69321 5.5CVE-2026-69453 5.5CVE-2026-69531 5.5CVE-2026-69554 5.5CVE-2026-72964 5.5CVE-2026-72966 5.5CVE-2026-83991 5.5CVE-2026-73004 5.5

Security Feature Bypass5

The attacker gets around a built-in protection such as SmartScreen, authentication, or an exploit mitigation. Usually dangerous in combination with another flaw.

5 CVEs this release, highest CVSS first:

CVE-2026-73025 9.8CVE-2026-69793 7.5CVE-2026-62801 6.5CVE-2026-66816 6.5CVE-2026-69674 5.5

Most-affected products

.NET 10.0 installed on Windows14

14 CVEs this release, highest CVSS first:

CVE-2026-69522 8.8CVE-2026-62886 7.8

.NET 8.0 installed on Windows14

14 CVEs this release, highest CVSS first:

CVE-2026-69522 8.8CVE-2026-62886 7.8

.NET 9.0 installed on Windows14

14 CVEs this release, highest CVSS first:

CVE-2026-69522 8.8CVE-2026-62886 7.8

Microsoft Office 2019 for 32-bit editions13

13 CVEs this release, highest CVSS first:

CVE-2026-78509 9.8CVE-2026-78510 9.8CVE-2026-69742 8.8CVE-2026-81385 8.8CVE-2026-69678 8.8CVE-2026-69767 8.8CVE-2026-69797 8.8CVE-2026-69556 8.8CVE-2026-69671 8.8CVE-2026-69686 8.8CVE-2026-69722 8.8CVE-2026-69759 8.8CVE-2026-69764 8.8CVE-2026-72972 8.8CVE-2026-72973 8.8CVE-2026-77901 8.8CVE-2026-78504 8.8CVE-2026-78511 8.8CVE-2026-78514 8.8CVE-2026-78517 8.8CVE-2026-78521 8.8CVE-2026-78525 8.8CVE-2026-80080 8.8CVE-2026-80085 8.8+72 more

Microsoft Office 2019 for 64-bit editions13

13 CVEs this release, highest CVSS first:

CVE-2026-78509 9.8CVE-2026-78510 9.8CVE-2026-69742 8.8CVE-2026-81385 8.8CVE-2026-69678 8.8CVE-2026-69767 8.8CVE-2026-69797 8.8CVE-2026-69556 8.8CVE-2026-69671 8.8CVE-2026-69686 8.8CVE-2026-69722 8.8CVE-2026-69759 8.8CVE-2026-69764 8.8CVE-2026-72972 8.8CVE-2026-72973 8.8CVE-2026-77901 8.8CVE-2026-78504 8.8CVE-2026-78511 8.8CVE-2026-78514 8.8CVE-2026-78517 8.8CVE-2026-78521 8.8CVE-2026-78525 8.8CVE-2026-80080 8.8CVE-2026-80085 8.8+72 more

Microsoft 365 Apps for Enterprise for 32-bit Systems12

12 CVEs this release, highest CVSS first:

CVE-2026-78509 9.8CVE-2026-78510 9.8CVE-2026-69742 8.8CVE-2026-81385 8.8CVE-2026-69678 8.8CVE-2026-69767 8.8CVE-2026-69797 8.8CVE-2026-69556 8.8CVE-2026-69671 8.8CVE-2026-69686 8.8CVE-2026-69722 8.8CVE-2026-69759 8.8CVE-2026-69764 8.8CVE-2026-72972 8.8CVE-2026-72973 8.8CVE-2026-77901 8.8CVE-2026-78504 8.8CVE-2026-78511 8.8CVE-2026-78514 8.8CVE-2026-78517 8.8CVE-2026-78521 8.8CVE-2026-78525 8.8CVE-2026-80080 8.8CVE-2026-80085 8.8+72 more

Windows 10 Version 1809 for 32-bit Systems10

10 CVEs this release, highest CVSS first:

CVE-2026-68839 9.8CVE-2026-69276 9.8CVE-2026-69408 9.8CVE-2026-69431 9.8CVE-2026-69463 9.8CVE-2026-69491 9.8CVE-2026-69493 9.8CVE-2026-69496 9.8CVE-2026-69525 9.8CVE-2026-69579 9.8CVE-2026-69586 9.8CVE-2026-69590 9.8CVE-2026-69595 9.8CVE-2026-69715 9.8CVE-2026-69730 9.8CVE-2026-69768 9.8CVE-2026-69769 9.8CVE-2026-69819 9.8CVE-2026-69824 9.8CVE-2026-69829 9.8CVE-2026-69845 9.8CVE-2026-69910 9.8CVE-2026-70296 9.8CVE-2026-72979 9.8+693 more

Windows 10 Version 1809 for x64-based Systems10

10 CVEs this release, highest CVSS first:

CVE-2026-68839 9.8CVE-2026-69276 9.8CVE-2026-69408 9.8CVE-2026-69431 9.8CVE-2026-69463 9.8CVE-2026-69491 9.8CVE-2026-69493 9.8CVE-2026-69496 9.8CVE-2026-69525 9.8CVE-2026-69579 9.8CVE-2026-69586 9.8CVE-2026-69590 9.8CVE-2026-69595 9.8CVE-2026-69715 9.8CVE-2026-69730 9.8CVE-2026-69768 9.8CVE-2026-69769 9.8CVE-2026-69819 9.8CVE-2026-69824 9.8CVE-2026-69829 9.8CVE-2026-69845 9.8CVE-2026-69910 9.8CVE-2026-70296 9.8CVE-2026-72979 9.8+693 more

By the numbers

Upcoming Patch Tuesday dates

Microsoft ships updates on the second Tuesday of each month. Add them to your calendar in one click.

Add all upcoming dates to your calendar (.ics)

Patch Tuesday history

Every month since we started tracking, newest first. Tracking 27 releases, 1,313 updates and 69 actively-exploited CVEs in total.

9146864572290July 2024: 49 CVEs, 0 Critical, 1 exploited, 0 ransomware-linkedJul24August 2024: 71 CVEs, 15 Critical, 6 exploited, 0 ransomware-linkedSeptember 2024: 71 CVEs, 1 Critical, 4 exploited, 0 ransomware-linkedOctober 2024: 104 CVEs, 34 Critical, 4 exploited, 1 ransomware-linkedOct24November 2024: 78 CVEs, 9 Critical, 2 exploited, 1 ransomware-linkedDecember 2024: 69 CVEs, 23 Critical, 1 exploited, 0 ransomware-linkedJanuary 2025: 148 CVEs, 15 Critical, 3 exploited, 0 ransomware-linkedJan25February 2025: 45 CVEs, 0 Critical, 2 exploited, 0 ransomware-linkedMarch 2025: 50 CVEs, 0 Critical, 7 exploited, 1 ransomware-linkedApril 2025: 107 CVEs, 0 Critical, 1 exploited, 1 ransomware-linkedApr25May 2025: 57 CVEs, 0 Critical, 5 exploited, 0 ransomware-linkedJune 2025: 61 CVEs, 0 Critical, 2 exploited, 0 ransomware-linkedJuly 2025: 134 CVEs, 17 Critical, 3 exploited, 3 ransomware-linkedJul25August 2025: 108 CVEs, 36 Critical, 0 exploited, 0 ransomware-linkedSeptember 2025: 77 CVEs, 0 Critical, 0 exploited, 0 ransomware-linkedOctober 2025: 144 CVEs, 17 Critical, 4 exploited, 0 ransomware-linkedOct25November 2025: 45 CVEs, 24 Critical, 2 exploited, 1 ransomware-linkedDecember 2025: 87 CVEs, 21 Critical, 1 exploited, 0 ransomware-linkedJanuary 2026: 108 CVEs, 11 Critical, 3 exploited, 0 ransomware-linkedJan26February 2026: 39 CVEs, 0 Critical, 5 exploited, 0 ransomware-linkedMarch 2026: 61 CVEs, 0 Critical, 0 exploited, 0 ransomware-linkedApril 2026: 152 CVEs, 21 Critical, 3 exploited, 0 ransomware-linkedApr26May 2026: 96 CVEs, 19 Critical, 2 exploited, 1 ransomware-linkedJune 2026: 156 CVEs, 22 Critical, 0 exploited, 0 ransomware-linkedJuly 2026: 547 CVEs, 34 Critical, 5 exploited, 0 ransomware-linkedJul26August 2026: 360 CVEs, 26 Critical, 1 exploited, 0 ransomware-linkedSeptember 2026: 914 CVEs, 21 Critical, 2 exploited, 0 ransomware-linked
CVEs fixed Actively exploited Critical Ransomware-linked
MonthUpdatesCVEsExploitedRansomwareCritical
September 2026601,16920118
August 20266775110108
July 2026695475034
June 2026331560022
May 202669962119
April 2026641523021
March 20263961000
February 20262939500
January 2026271083011
December 202555871021
November 202544452124
October 2025651444017
September 20253877000
August 2025841080036
July 2025511343317
June 20254761200
May 20253457500
April 202535107110
March 20253350710
February 20252545200
January 2025471483015
December 202445691023
November 20243578219
October 2024721044134
September 20244571401
August 202449716015
July 20243249100

Month-by-month recap

Expand any month for a plain-English summary of that Patch Tuesday.

September 20261,169 CVEs fixed2 exploited

The September 2026 Microsoft Patch Tuesday shipped 60 updates (KB articles) fixing 1,169 CVEs, 118 of them rated Critical severity. Those are Microsoft's own counts; Senserva tracks 914 of them against update articles we hold pages for. 2 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

August 2026751 CVEs fixed1 exploited

The August 2026 Microsoft Patch Tuesday shipped 67 updates (KB articles) fixing 751 CVEs, 108 of them rated Critical severity. Those are Microsoft's own counts; Senserva tracks 360 of them against update articles we hold pages for. 1 was already being exploited in the wild (on the CISA KEV list) and needed patching first.

July 2026547 CVEs fixed5 exploited

The July 2026 Microsoft Patch Tuesday shipped 69 updates (KB articles) fixing 547 CVEs, 34 of them rated Critical severity. 5 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

June 2026156 CVEs fixed

The June 2026 Microsoft Patch Tuesday shipped 33 updates (KB articles) fixing 156 CVEs, 22 of them rated Critical severity. None from this release were on the CISA KEV exploited list at the time.

May 202696 CVEs fixed2 exploited

The May 2026 Microsoft Patch Tuesday shipped 69 updates (KB articles) fixing 96 CVEs, 19 of them rated Critical severity. 2 were already being exploited in the wild (on the CISA KEV list) and needed patching first. 1 was linked to ransomware activity.

April 2026152 CVEs fixed3 exploited

The April 2026 Microsoft Patch Tuesday shipped 64 updates (KB articles) fixing 152 CVEs, 21 of them rated Critical severity. 3 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

March 202661 CVEs fixed

The March 2026 Microsoft Patch Tuesday shipped 39 updates (KB articles) fixing 61 CVEs, 0 of them rated Critical severity. None from this release were on the CISA KEV exploited list at the time.

February 202639 CVEs fixed5 exploited

The February 2026 Microsoft Patch Tuesday shipped 29 updates (KB articles) fixing 39 CVEs, 0 of them rated Critical severity. 5 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

January 2026108 CVEs fixed3 exploited

The January 2026 Microsoft Patch Tuesday shipped 27 updates (KB articles) fixing 108 CVEs, 11 of them rated Critical severity. 3 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

December 202587 CVEs fixed1 exploited

The December 2025 Microsoft Patch Tuesday shipped 55 updates (KB articles) fixing 87 CVEs, 21 of them rated Critical severity. 1 was already being exploited in the wild (on the CISA KEV list) and needed patching first.

November 202545 CVEs fixed2 exploited

The November 2025 Microsoft Patch Tuesday shipped 44 updates (KB articles) fixing 45 CVEs, 24 of them rated Critical severity. 2 were already being exploited in the wild (on the CISA KEV list) and needed patching first. 1 was linked to ransomware activity.

October 2025144 CVEs fixed4 exploited

The October 2025 Microsoft Patch Tuesday shipped 65 updates (KB articles) fixing 144 CVEs, 17 of them rated Critical severity. 4 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

September 202577 CVEs fixed

The September 2025 Microsoft Patch Tuesday shipped 38 updates (KB articles) fixing 77 CVEs, 0 of them rated Critical severity. None from this release were on the CISA KEV exploited list at the time.

August 2025108 CVEs fixed

The August 2025 Microsoft Patch Tuesday shipped 84 updates (KB articles) fixing 108 CVEs, 36 of them rated Critical severity. None from this release were on the CISA KEV exploited list at the time.

July 2025134 CVEs fixed3 exploited

The July 2025 Microsoft Patch Tuesday shipped 51 updates (KB articles) fixing 134 CVEs, 17 of them rated Critical severity. 3 were already being exploited in the wild (on the CISA KEV list) and needed patching first. 3 were linked to ransomware activity.

June 202561 CVEs fixed2 exploited

The June 2025 Microsoft Patch Tuesday shipped 47 updates (KB articles) fixing 61 CVEs, 0 of them rated Critical severity. 2 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

May 202557 CVEs fixed5 exploited

The May 2025 Microsoft Patch Tuesday shipped 34 updates (KB articles) fixing 57 CVEs, 0 of them rated Critical severity. 5 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

April 2025107 CVEs fixed1 exploited

The April 2025 Microsoft Patch Tuesday shipped 35 updates (KB articles) fixing 107 CVEs, 0 of them rated Critical severity. 1 was already being exploited in the wild (on the CISA KEV list) and needed patching first. 1 was linked to ransomware activity.

March 202550 CVEs fixed7 exploited

The March 2025 Microsoft Patch Tuesday shipped 33 updates (KB articles) fixing 50 CVEs, 0 of them rated Critical severity. 7 were already being exploited in the wild (on the CISA KEV list) and needed patching first. 1 was linked to ransomware activity.

February 202545 CVEs fixed2 exploited

The February 2025 Microsoft Patch Tuesday shipped 25 updates (KB articles) fixing 45 CVEs, 0 of them rated Critical severity. 2 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

January 2025148 CVEs fixed3 exploited

The January 2025 Microsoft Patch Tuesday shipped 47 updates (KB articles) fixing 148 CVEs, 15 of them rated Critical severity. 3 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

December 202469 CVEs fixed1 exploited

The December 2024 Microsoft Patch Tuesday shipped 45 updates (KB articles) fixing 69 CVEs, 23 of them rated Critical severity. 1 was already being exploited in the wild (on the CISA KEV list) and needed patching first.

November 202478 CVEs fixed2 exploited

The November 2024 Microsoft Patch Tuesday shipped 35 updates (KB articles) fixing 78 CVEs, 9 of them rated Critical severity. 2 were already being exploited in the wild (on the CISA KEV list) and needed patching first. 1 was linked to ransomware activity.

October 2024104 CVEs fixed4 exploited

The October 2024 Microsoft Patch Tuesday shipped 72 updates (KB articles) fixing 104 CVEs, 34 of them rated Critical severity. 4 were already being exploited in the wild (on the CISA KEV list) and needed patching first. 1 was linked to ransomware activity.

September 202471 CVEs fixed4 exploited

The September 2024 Microsoft Patch Tuesday shipped 45 updates (KB articles) fixing 71 CVEs, 1 of them rated Critical severity. 4 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

August 202471 CVEs fixed6 exploited

The August 2024 Microsoft Patch Tuesday shipped 49 updates (KB articles) fixing 71 CVEs, 15 of them rated Critical severity. 6 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

July 202449 CVEs fixed1 exploited

The July 2024 Microsoft Patch Tuesday shipped 32 updates (KB articles) fixing 49 CVEs, 0 of them rated Critical severity. 1 was already being exploited in the wild (on the CISA KEV list) and needed patching first.

Trusted Patch Tuesday resources

The analyses the security community reads each month. Cross-reference these with the ranked view above.

Microsoft Security Update GuideThe authoritative source: every CVE Microsoft fixed this month, affected products, and KBs.
CISA Known Exploited VulnerabilitiesThe U.S. catalog of CVEs confirmed exploited in the wild. Patch these first.
Zero Day Initiative: Security Update ReviewIn-depth monthly analysis from the researchers behind Pwn2Own.
Tenable Patch Tuesday analysisMonthly breakdowns of the CVEs that matter and why.
Rapid7 Patch TuesdayPatch Tuesday roundups with exploitation and attacker context.
Qualys Threat ResearchPatch Tuesday roundups and prioritization guidance.
SANS Internet Storm CenterCommunity Patch Tuesday dashboard and per-CVE detail.
CrowdStrike Patch Tuesday analysisMonthly Patch Tuesday breakdowns with adversary and exploitation context.
Krebs on SecurityPlain-English monthly Patch Tuesday coverage.
BleepingComputerNews coverage of each Patch Tuesday and emerging exploits.

Frequently asked questions

What is Patch Tuesday?

Patch Tuesday is the second Tuesday of each month, when Microsoft releases its scheduled security updates across Windows, Office, Exchange, SharePoint, and the rest of the Microsoft 365, Intune, Defender, and Entra ID stack. Out-of-band updates ship between Patch Tuesdays when a fix cannot wait, and this page covers both. Senserva ranks each release by what attackers are actually exploiting, ties every CVE to the KB that fixes it, and, in your own tenant, tells you which of these updates are actually missing on your devices.

When is the next Patch Tuesday?

The next Microsoft Patch Tuesday is October 13, 2026. It falls on the second Tuesday of every month; upcoming dates are listed on this page.

What was in the latest Patch Tuesday?

The September 2026 release included 60 updates (KBs) fixing 1,169 CVEs, of which 2 are actively exploited (CISA KEV). The exploited CVEs, the highest-risk CVEs, and the full history are on this page.

Which Patch Tuesday updates should I install first?

Install the actively-exploited (CISA KEV) fixes first, then the highest EPSS and CVSS ones, then the rest. This page ranks every release that way, and Senserva applies the same order to the updates actually missing on your own devices.

What is a zero-day on Patch Tuesday?

A zero-day is a vulnerability already being exploited (or publicly disclosed) before a patch was available. Those are the CVEs to patch immediately; this page calls out the actively-exploited ones each month.

How often is this page updated?

Automatically, every day. The data refreshes from Microsoft MSRC, CISA KEV, and FIRST.org EPSS, and the month-by-month history is preserved so the archive only grows.

Is this Patch Tuesday tracker free?

Yes, free with no sign-in. Running Senserva adds the part a public page cannot: which of these updates are actually missing on your devices, ranked, so you fix the right things first.

Can I use this Patch Tuesday data with my own AI?

Yes. A free copy-paste AI prompt just under the exploited-CVE list is composed from this release: the update and CVE counts, and the actively-exploited CVE names with their CVSS scores. Paste it into Claude, ChatGPT, or Copilot to get a first-24-hours plan and a team briefing in your own words.

The Microsoft CVE and patch resource center

Everything here is free, refreshed once a day (early morning US Central), and cross-linked. Start with this month, then drill into any CVE, KB, product, or month since tracking began.

Microsoft patch trackerEvery KB and the CVEs it fixes, searchable and ranked by CISA KEV and EPSS.CVE and vulnerability managementThe plain-English Microsoft CVE reference: what to fix first and why.Actively exploited (CISA KEV)The third-party vulnerabilities attackers are using right now, EPSS-ranked.Open source patch trackerExploited and high-risk CVEs across the open-source stack.End of life trackerSoftware and Windows versions running past their support dates.Patch Tuesday historyEvery release since tracking began, charted, with plain-English month recaps.

Data access: Patch Tuesday RSS · JSON patch API · calendar (.ics). Plus a page for every CVE and KB, linked throughout. JSON and RSS feeds included, no login required: all feeds and the API.

AI patch management: put your own AI on this data

Now see your own patch state.

Siemserva by Senserva reads your Microsoft 365, Intune, Defender, and Entra ID environment and turns this release into your list: every update still missing, on every device, ranked by what attackers are actually exploiting. The 650+ configuration checks come with it.

1Find it2Fix it3Prove it
Start my free patch auditAll you do is register.

Reference: the Microsoft patching guide, how Intune, Windows Autopatch, Defender, and Azure Update Manager fit together, and where third-party patch vendors fit in.

Data notice: this page, the feeds, and the API are provided as is, for informational purposes only, without warranty of any kind. Senserva, LLC does not guarantee the accuracy, completeness, or timeliness of third-party data and accepts no liability for actions taken based on it; verify against the primary source before acting. All use of this data is subject to the Senserva EULA.

Patching across Intune, Windows Autopatch, Defender, Azure, and your endpoint managers: see Senserva patching in action.