Patch and vulnerability tracker / Microsoft Patch Tuesday

Microsoft Patch Tuesday September 2026: every CVE and patch, ranked by risk

The front page of Microsoft patching: every CVE and the update (KB) that fixes it, the day it ships. September 2026 shipped 60 updates fixing 1,169 CVEs, 118 of them Critical Severity and 2 already confirmed exploited in the wild. Senserva holds 27 months of releases this way, every month measured the same, so a spike is visible rather than asserted.

Zero-days are called out by name, and each release is ranked by what attackers actually exploit. Every KB links its own page with the download, the known issues Microsoft documents, a PowerShell installed-check, and the newer package that supersedes it when one has shipped. Patch Tuesday trends, the full history, calendar, and feeds live here, alongside the voices of the other Patch Tuesday trackers we follow.

Next Patch Tuesday: October 13, 2026, in 23 days.

Data refreshed twice a day, morning and afternoon US Central.

Senserva is a Microsoft Intelligent Security Association memberOpen the full patch tracker

This Patch TuesdayELEVATEDbecause 2 CVEs are already being exploited in the wildNext: October 13, 2026 (23 days)

September 2026 at a glance

Microsoft shipped 60 updates fixing 1,169 CVEs this release.
60
Updates (KBs)
1,169
CVEs fixed
2
Exploited zero-day, new this release
2
On the CISA KEV list
0
Ransomware-linked
118
Critical, rated by Microsoft

Figures are Microsoft's own, from MSRC CVRF 2026-Sep, read on 2026-09-08. Microsoft's Severity split covers 1,146 of the 1,169; 23 carry no rating. Senserva tracks 915 of them against update articles we hold pages for; the difference is largely Azure Linux entries that ship no KB article.

See the historySubscribe (RSS)

The Senserva AI read pre-beta

Two zero-days are already being exploited this month: CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows Advanced Local Procedure Call), both elevation of privilege flaws already on the CISA KEV catalog. Patch these first across all Windows endpoints and servers, since active exploitation means attackers already have working code. This is not a reassuring month. From there, work through the 118 Critical severity fixes among the 1,169 CVEs Microsoft addressed across 61 updates, prioritizing .NET 10.0, 8.0, and 9.0 on Windows and Office 2019 and Microsoft 365 Apps for Enterprise, which show the heaviest concentration of fixes.

Against the trailing 12-month average of 159 CVEs, 2 exploited, and 16 Critical severity issues per month, this release is far larger in volume, with Critical severity counts more than seven times typical. The exploited count matches the recent average exactly, so ongoing active exploitation is now a monthly baseline, not an anomaly. Treat patching posture accordingly: move fast on the two zero-days, then plan extra time for the unusually large Critical severity backlog.

Pre-beta. Generated by Senserva AI from the live release data on this page, 2026-09-18. Regenerated when the data changes. The human take is above.
Take this release to your AI

Composed from the live September 2026 release data above, refreshed twice a day (morning and afternoon US Central). Copy it into Claude, ChatGPT, or Copilot. Free, no sign-in.

What those we follow are saying

Verbatim headlines from the trusted Patch Tuesday sources, pulled live from their own feeds (as of 2026-09-20). Items that name a CVE are also linked from that CVE's row above. For our own opinion, read the Senserva take on the blog.

“Week in review: Cisco patches exploited email gateway 0-day, Revolut breach”Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: What we know about the Revolut data breach so far Someone impersonating a government agency, using an email address on…Help Net Security, 2026-09-20
“Critical Orkes Conductor Vulnerability Exploited in Attacks”CVE-2026-58138 is an unauthenticated remote code execution vulnerability that attackers can exploit via inline workflow definitions.SecurityWeek, 2026-09-18 · CVE-2026-58138
“Microsoft Patches 18 Vulnerabilities in AI, Cloud Products”Microsoft fixed vulnerabilities across Azure and AI-branded products, with privilege escalation flaws accounting for the majority.SecurityWeek, 2026-09-18
“Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched”Four major AI coding agents, Claude Code, Codex, GitHub Copilot and Gemini CLI, all share the same zero-click RCE vulnerability, one that could give an attacker the same reach into a company’s systems and data as…Help Net Security, 2026-09-18
“Cisco Zero-Day Highlights API Endpoint Authentication Issues”The authentication bypass flaw CVE-2026-76460 impacts Cisco's Identity Services Engine (ISE) and received a maximum 10 out of 10 CVSS score.Dark Reading, 2026-09-18 · CVE-2026-76460
“Microsoft fixes broken copy and paste for Excel 2016 users”Microsoft has fixed a known issue that causes copy-and-paste failures for some Excel users after installing the September 2026 KB5002914 security update.BleepingComputer, 2026-09-18
“Microsoft fixes bug behind ‘Defender Antivirus is turned off’ alerts”Microsoft has resolved a known issue that causes incorrect alerts warning that Defender Antivirus was turned off after installing recent updates.BleepingComputer, 2026-09-18
“Microsoft Teams will let admins block custom file extensions”Microsoft Teams will soon let administrators tweak the list of file extensions commonly associated with security threats to meet their company's security requirements.BleepingComputer, 2026-09-18
“Gyazo server flaw exploited to steal 23.6 million user records”BleepingComputer, 2026-09-18
“Improving email security outcomes with real-world Microsoft Defender insights”The latest email security benchmarking reports show strong Microsoft Defender performance across pre-delivery and post-delivery scenarios and reveal where threats and defenses continue to evolve.Microsoft Security Blog, 2026-09-17
“From guidance to action: Security fundamentals that materially reduce risk”AI has made fundamental changes to the operating environment for cybersecurity. Explore exposure management guidance on recommended controls and take action and stay ahead of cyberthreats.Microsoft Security Blog, 2026-09-17
“The Apple Security Update Review for September 2026”Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.Zero Day Initiative, 2026-09-16 · CVE-2026-65400, CVE-2026-65414, CVE-2026-65346, CVE-2026-84607
“Microsoft Issues Emergency Fixes After Massive Patch Tuesday”You can't make an omelet without breaking a few eggs, and you can't patch nearly 1,000 CVEs without a few glitches.Dark Reading, 2026-09-15
“Before You Patch. Why Patch Reliability Matters for Confident Deployment”Executive Summary Microsoft’s September 2026 security updates, KB5124008 and KB5124012, have been linked to USB audio failures on some Windows systems, highlighting the operational risk that can accompany security…Qualys, 2026-09-15

Critical is rarer, and bigger

Every Microsoft update we track, grouped by the severity Microsoft assigned it, across 1,088 updates and 3,970 distinct CVEs (as of 2026-09-18). The count is UPDATES, not CVE fixes, and the difference matters: Important updates outnumber Critical ones, but a Critical update carries several times as many CVE fixes, because it is usually a cumulative one. So a Critical month is not just more urgent, it is a wider deployment. Counts per update are under each bar. The bars add up to 1,105 rather than 1,088 because 17 updates were rated at more than one severity.

Important774

9,536 CVE fixes, 12.3 per update

Critical261

22,910 CVE fixes, 87.8 per update

Moderate70

83 CVE fixes, 1.2 per update

Actively exploited this release

These are the September 2026 CVEs already being exploited in the wild, flagged by Microsoft in its release document or listed on CISA KEV. Patch them first, everywhere.

CVE-2026-81963HighWindows Update Stack Elevation of Privilege VulnerabilityCVSS 7.8

An Elevation of Privilege vulnerability affecting Windows Server 2025 (Server Core installation).

Affects: Windows Server 2025 (Server Core installation), Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems

More on CVE-2026-81963 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

Covering this CVE: Rapid7 · Tenable · Zero Day Initiative

CVE-2026-85880HighWindows Advanced Local Procedure Call (ALPC) Elevation of Privilege VulnerabilityCVSS 7.8

An Elevation of Privilege vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-85880 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

Covering this CVE: Rapid7 · Tenable · Zero Day Initiative

Highest-risk fixes this release

Not yet flagged as exploited, but critical-severity (CVSS 8.8+) and worth prioritizing.

CVE-2026-68839CriticalWindows USB Mass Storage Class Driver Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-68839 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69276CriticalMicrosoft UxTheme Library (uxtheme.dll) Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69276 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69408CriticalMicrosoft Windows Media Foundation Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69408 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69431CriticalTelnet Client Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69431 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69463CriticalWindows NTFS Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69463 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69491CriticalMicrosoft DirectMusic Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69491 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69493CriticalWindows Event Logging Service Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69493 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69496CriticalWindows Compressed Folder Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69496 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69525CriticalRemote Desktop Services Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69525 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

Covering this CVE: Tenable · Zero Day Initiative

CVE-2026-69579CriticalWindows Message Queuing Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69579 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

Covering this CVE: Zero Day Initiative

CVE-2026-69586CriticalMicrosoft Windows PDF Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69586 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

CVE-2026-69590CriticalWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows 10 Version 1809 for 32-bit Systems.

Affects: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019

More on CVE-2026-69590 ›

References: Microsoft · NVD · Tenable · Patch Tuesday coverage

September 2026 breakdown

What Microsoft fixed this release, by impact type and by product. Expand any row for what it means and the CVEs behind it, each linked to its full page.

By impact type

Elevation of Privilege428

The attacker gains higher permissions than they were granted, for example from a standard user to administrator or SYSTEM. These are the workhorses of exploit chains.

428 CVEs this release, highest CVSS first:

CVE-2026-69641 9.1CVE-2026-73012 8.8CVE-2026-80096 8.8CVE-2026-83996 8.8CVE-2026-69784 8.8CVE-2026-69740 8.8CVE-2026-69439 8.8CVE-2026-47295 8.8CVE-2026-55002 8.8CVE-2026-66814 8.8CVE-2026-66818 8.8CVE-2026-66819 8.8CVE-2026-66820 8.8CVE-2026-67368 8.8CVE-2026-67370 8.8CVE-2026-67381 8.8CVE-2026-73028 8.8CVE-2026-77480 8.8CVE-2026-77483 8.8CVE-2026-77487 8.8CVE-2026-69464 8.8CVE-2026-69716 8.8CVE-2026-77503 8.4CVE-2026-69846 8.2+404 more

Remote Code Execution241

The attacker runs their own code on the target, usually the most serious class of vulnerability. Prioritize internet-facing and unpatched systems first.

241 CVEs this release, highest CVSS first:

CVE-2026-68839 9.8CVE-2026-69276 9.8CVE-2026-69408 9.8CVE-2026-69431 9.8CVE-2026-69463 9.8CVE-2026-69491 9.8CVE-2026-69493 9.8CVE-2026-69496 9.8CVE-2026-69525 9.8CVE-2026-69579 9.8CVE-2026-69586 9.8CVE-2026-69590 9.8CVE-2026-69595 9.8CVE-2026-69715 9.8CVE-2026-69730 9.8CVE-2026-69768 9.8CVE-2026-69769 9.8CVE-2026-69819 9.8CVE-2026-69824 9.8CVE-2026-69829 9.8CVE-2026-69845 9.8CVE-2026-69910 9.8CVE-2026-70296 9.8CVE-2026-72979 9.8+217 more

Other132

Other or uncategorized impact types in this release.

132 CVEs this release, highest CVSS first:

CVE-2026-68830CVE-2026-68831CVE-2026-68843CVE-2026-68851CVE-2026-68852CVE-2026-68874CVE-2026-68881CVE-2026-68886CVE-2026-68891CVE-2026-68895CVE-2026-69286CVE-2026-69288CVE-2026-69294CVE-2026-69303CVE-2026-69308CVE-2026-69315CVE-2026-69316CVE-2026-69317CVE-2026-69318CVE-2026-69321CVE-2026-69343CVE-2026-69345CVE-2026-69349CVE-2026-69351+108 more

Information Disclosure62

The flaw leaks data that should be protected, such as memory contents, file data, or authentication tokens. Leaked credentials often feed the next stage of an attack.

62 CVEs this release, highest CVSS first:

CVE-2026-69443 7.5CVE-2026-70587 7.5CVE-2026-71330 7.5CVE-2026-72932 7.5CVE-2026-72989 7.5CVE-2026-70579 7.5CVE-2026-66304 7.5CVE-2026-69267 6.5CVE-2026-69297 6.5CVE-2026-69395 6.5CVE-2026-72942 6.5CVE-2026-78453 6.5CVE-2026-70019 6.5CVE-2026-58649 6.5CVE-2026-50468 6.5CVE-2026-54116 6.5CVE-2026-67386 6.5CVE-2026-67390 6.5CVE-2026-67393 6.5CVE-2026-67624 6.5CVE-2026-67629 6.5CVE-2026-67630 6.5CVE-2026-67645 6.5CVE-2026-67648 6.5+38 more

Denial of Service42

The attacker crashes or hangs a service, taking it offline. Lower confidentiality impact, but a real availability risk for exposed services.

42 CVEs this release, highest CVSS first:

CVE-2026-68887 7.5CVE-2026-69329 7.5CVE-2026-69342 7.5CVE-2026-69428 7.5CVE-2026-69631 7.5CVE-2026-69760 7.5CVE-2026-69881 7.5CVE-2026-70065 7.5CVE-2026-77494 7.5CVE-2026-77498 7.5CVE-2026-77499 7.5CVE-2026-77501 7.5CVE-2026-77502 7.5CVE-2026-77886 7.5CVE-2026-77888 7.5CVE-2026-77889 7.5CVE-2026-77890 7.5CVE-2026-77893 7.5CVE-2026-77895 7.5CVE-2026-83989 7.5CVE-2026-84001 7.5CVE-2026-69587 7.5CVE-2026-69588 7.5CVE-2026-69809 7.5+18 more

Spoofing12

The attacker impersonates a user, system, or piece of content to trick a victim. Common in phishing and man-in-the-middle scenarios.

12 CVEs this release, highest CVSS first:

CVE-2026-69356 9.3CVE-2026-69646 8.3CVE-2026-69680 8.1CVE-2026-70563 8.1CVE-2026-62759 7.5CVE-2026-69402 7.3CVE-2026-69417 7.3CVE-2026-66305 7.1CVE-2026-69361 6.5CVE-2026-64918 6.5CVE-2026-63523 6.5CVE-2026-69642 6.5

Security Feature Bypass4

The attacker gets around a built-in protection such as SmartScreen, authentication, or an exploit mitigation. Usually dangerous in combination with another flaw.

4 CVEs this release, highest CVSS first:

CVE-2026-73025 9.8CVE-2026-69793 7.5CVE-2026-62801 6.5CVE-2026-66816 6.5

Tampering3

The attacker modifies data or code without authorization, undermining the integrity of the system.

3 CVEs this release, highest CVSS first:

CVE-2026-69482 7.1CVE-2026-69624 6.5CVE-2026-69375 6.5

Most-affected products

.NET 10.0 installed on Windows14

14 CVEs this release, highest CVSS first:

CVE-2026-69522 8.8CVE-2026-62886 7.8

.NET 8.0 installed on Windows14

14 CVEs this release, highest CVSS first:

CVE-2026-69522 8.8CVE-2026-62886 7.8

.NET 9.0 installed on Windows14

14 CVEs this release, highest CVSS first:

CVE-2026-69522 8.8CVE-2026-62886 7.8

Microsoft Office 2019 for 32-bit editions13

13 CVEs this release, highest CVSS first:

CVE-2026-78509 9.8CVE-2026-78510 9.8CVE-2026-69742 8.8CVE-2026-81385 8.8CVE-2026-69678 8.8CVE-2026-69767 8.8CVE-2026-69797 8.8CVE-2026-69556 8.8CVE-2026-69671 8.8CVE-2026-69686 8.8CVE-2026-69722 8.8CVE-2026-69759 8.8CVE-2026-69764 8.8CVE-2026-72972 8.8CVE-2026-72973 8.8CVE-2026-77901 8.8CVE-2026-78504 8.8CVE-2026-78511 8.8CVE-2026-78514 8.8CVE-2026-78517 8.8CVE-2026-78521 8.8CVE-2026-78525 8.8CVE-2026-80080 8.8CVE-2026-80085 8.8+72 more

Microsoft Office 2019 for 64-bit editions13

13 CVEs this release, highest CVSS first:

CVE-2026-78509 9.8CVE-2026-78510 9.8CVE-2026-69742 8.8CVE-2026-81385 8.8CVE-2026-69678 8.8CVE-2026-69767 8.8CVE-2026-69797 8.8CVE-2026-69556 8.8CVE-2026-69671 8.8CVE-2026-69686 8.8CVE-2026-69722 8.8CVE-2026-69759 8.8CVE-2026-69764 8.8CVE-2026-72972 8.8CVE-2026-72973 8.8CVE-2026-77901 8.8CVE-2026-78504 8.8CVE-2026-78511 8.8CVE-2026-78514 8.8CVE-2026-78517 8.8CVE-2026-78521 8.8CVE-2026-78525 8.8CVE-2026-80080 8.8CVE-2026-80085 8.8+72 more

Microsoft 365 Apps for Enterprise for 32-bit Systems12

12 CVEs this release, highest CVSS first:

CVE-2026-78509 9.8CVE-2026-78510 9.8CVE-2026-69742 8.8CVE-2026-81385 8.8CVE-2026-69678 8.8CVE-2026-69767 8.8CVE-2026-69797 8.8CVE-2026-69556 8.8CVE-2026-69671 8.8CVE-2026-69686 8.8CVE-2026-69722 8.8CVE-2026-69759 8.8CVE-2026-69764 8.8CVE-2026-72972 8.8CVE-2026-72973 8.8CVE-2026-77901 8.8CVE-2026-78504 8.8CVE-2026-78511 8.8CVE-2026-78514 8.8CVE-2026-78517 8.8CVE-2026-78521 8.8CVE-2026-78525 8.8CVE-2026-80080 8.8CVE-2026-80085 8.8+72 more

Windows 10 Version 1809 for 32-bit Systems11

11 CVEs this release, highest CVSS first:

CVE-2026-68839 9.8CVE-2026-69276 9.8CVE-2026-69408 9.8CVE-2026-69431 9.8CVE-2026-69463 9.8CVE-2026-69491 9.8CVE-2026-69493 9.8CVE-2026-69496 9.8CVE-2026-69525 9.8CVE-2026-69579 9.8CVE-2026-69586 9.8CVE-2026-69590 9.8CVE-2026-69595 9.8CVE-2026-69715 9.8CVE-2026-69730 9.8CVE-2026-69768 9.8CVE-2026-69769 9.8CVE-2026-69819 9.8CVE-2026-69824 9.8CVE-2026-69829 9.8CVE-2026-69845 9.8CVE-2026-69910 9.8CVE-2026-70296 9.8CVE-2026-72979 9.8+695 more

Windows 10 Version 1809 for x64-based Systems10

10 CVEs this release, highest CVSS first:

CVE-2026-68839 9.8CVE-2026-69276 9.8CVE-2026-69408 9.8CVE-2026-69431 9.8CVE-2026-69463 9.8CVE-2026-69491 9.8CVE-2026-69493 9.8CVE-2026-69496 9.8CVE-2026-69525 9.8CVE-2026-69579 9.8CVE-2026-69586 9.8CVE-2026-69590 9.8CVE-2026-69595 9.8CVE-2026-69715 9.8CVE-2026-69730 9.8CVE-2026-69768 9.8CVE-2026-69769 9.8CVE-2026-69819 9.8CVE-2026-69824 9.8CVE-2026-69829 9.8CVE-2026-69845 9.8CVE-2026-69910 9.8CVE-2026-70296 9.8CVE-2026-72979 9.8+693 more

By the numbers

Upcoming Patch Tuesday dates

Microsoft ships updates on the second Tuesday of each month. Add them to your calendar in one click.

Add all upcoming dates to your calendar (.ics)

Patch Tuesday history

Every month since we started tracking, newest first. Tracking 27 releases, 1,315 updates and 69 actively-exploited CVEs in total.

9156864582290July 2024: 49 CVEs, 0 Critical, 1 exploited, 0 ransomware-linkedJul24August 2024: 71 CVEs, 15 Critical, 6 exploited, 0 ransomware-linkedSeptember 2024: 71 CVEs, 1 Critical, 4 exploited, 0 ransomware-linkedOctober 2024: 104 CVEs, 34 Critical, 4 exploited, 1 ransomware-linkedOct24November 2024: 78 CVEs, 9 Critical, 2 exploited, 1 ransomware-linkedDecember 2024: 69 CVEs, 23 Critical, 1 exploited, 0 ransomware-linkedJanuary 2025: 148 CVEs, 15 Critical, 3 exploited, 0 ransomware-linkedJan25February 2025: 45 CVEs, 0 Critical, 2 exploited, 0 ransomware-linkedMarch 2025: 52 CVEs, 0 Critical, 7 exploited, 1 ransomware-linkedApril 2025: 107 CVEs, 0 Critical, 1 exploited, 1 ransomware-linkedApr25May 2025: 56 CVEs, 0 Critical, 5 exploited, 0 ransomware-linkedJune 2025: 64 CVEs, 0 Critical, 2 exploited, 0 ransomware-linkedJuly 2025: 129 CVEs, 17 Critical, 3 exploited, 3 ransomware-linkedJul25August 2025: 116 CVEs, 36 Critical, 0 exploited, 0 ransomware-linkedSeptember 2025: 77 CVEs, 0 Critical, 0 exploited, 0 ransomware-linkedOctober 2025: 144 CVEs, 17 Critical, 4 exploited, 0 ransomware-linkedOct25November 2025: 45 CVEs, 24 Critical, 2 exploited, 1 ransomware-linkedDecember 2025: 87 CVEs, 21 Critical, 1 exploited, 0 ransomware-linkedJanuary 2026: 108 CVEs, 11 Critical, 3 exploited, 0 ransomware-linkedJan26February 2026: 39 CVEs, 0 Critical, 5 exploited, 0 ransomware-linkedMarch 2026: 61 CVEs, 0 Critical, 0 exploited, 0 ransomware-linkedApril 2026: 151 CVEs, 20 Critical, 3 exploited, 0 ransomware-linkedApr26May 2026: 98 CVEs, 19 Critical, 2 exploited, 1 ransomware-linkedJune 2026: 157 CVEs, 21 Critical, 0 exploited, 0 ransomware-linkedJuly 2026: 551 CVEs, 34 Critical, 5 exploited, 0 ransomware-linkedJul26August 2026: 389 CVEs, 26 Critical, 1 exploited, 0 ransomware-linkedSeptember 2026: 915 CVEs, 29 Critical, 2 exploited, 0 ransomware-linked
CVEs fixed Actively exploited Critical Ransomware-linked
MonthUpdatesCVEsExploitedRansomwareCritical
September 2026601,16920118
August 20266775110108
July 2026695515034
June 2026321570021
May 202669982119
April 2026631513020
March 20263961000
February 20262939500
January 2026271083011
December 202555871021
November 202544452124
October 2025651444017
September 20253877000
August 2025841160036
July 2025511293317
June 20254764200
May 20253456500
April 202535107110
March 20253352710
February 20252545200
January 2025471483015
December 202445691023
November 20243578219
October 2024721044134
September 20244571401
August 202449716015
July 20243249100

Month-by-month recap

Expand any month for a plain-English summary of that Patch Tuesday.

September 20261,169 CVEs fixed2 exploited

The September 2026 Microsoft Patch Tuesday shipped 60 updates (KB articles) fixing 1,169 CVEs, 118 of them rated Critical severity. Those are Microsoft's own counts; Senserva tracks 915 of them against update articles we hold pages for. 2 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

August 2026751 CVEs fixed1 exploited

The August 2026 Microsoft Patch Tuesday shipped 67 updates (KB articles) fixing 751 CVEs, 108 of them rated Critical severity. Those are Microsoft's own counts; Senserva tracks 389 of them against update articles we hold pages for. 1 was already being exploited in the wild (on the CISA KEV list) and needed patching first.

July 2026551 CVEs fixed5 exploited

The July 2026 Microsoft Patch Tuesday shipped 69 updates (KB articles) fixing 551 CVEs, 34 of them rated Critical severity. 5 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

June 2026157 CVEs fixed

The June 2026 Microsoft Patch Tuesday shipped 32 updates (KB articles) fixing 157 CVEs, 21 of them rated Critical severity. None from this release were on the CISA KEV exploited list at the time.

May 202698 CVEs fixed2 exploited

The May 2026 Microsoft Patch Tuesday shipped 69 updates (KB articles) fixing 98 CVEs, 19 of them rated Critical severity. 2 were already being exploited in the wild (on the CISA KEV list) and needed patching first. 1 was linked to ransomware activity.

April 2026151 CVEs fixed3 exploited

The April 2026 Microsoft Patch Tuesday shipped 63 updates (KB articles) fixing 151 CVEs, 20 of them rated Critical severity. 3 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

March 202661 CVEs fixed

The March 2026 Microsoft Patch Tuesday shipped 39 updates (KB articles) fixing 61 CVEs, 0 of them rated Critical severity. None from this release were on the CISA KEV exploited list at the time.

February 202639 CVEs fixed5 exploited

The February 2026 Microsoft Patch Tuesday shipped 29 updates (KB articles) fixing 39 CVEs, 0 of them rated Critical severity. 5 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

January 2026108 CVEs fixed3 exploited

The January 2026 Microsoft Patch Tuesday shipped 27 updates (KB articles) fixing 108 CVEs, 11 of them rated Critical severity. 3 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

December 202587 CVEs fixed1 exploited

The December 2025 Microsoft Patch Tuesday shipped 55 updates (KB articles) fixing 87 CVEs, 21 of them rated Critical severity. 1 was already being exploited in the wild (on the CISA KEV list) and needed patching first.

November 202545 CVEs fixed2 exploited

The November 2025 Microsoft Patch Tuesday shipped 44 updates (KB articles) fixing 45 CVEs, 24 of them rated Critical severity. 2 were already being exploited in the wild (on the CISA KEV list) and needed patching first. 1 was linked to ransomware activity.

October 2025144 CVEs fixed4 exploited

The October 2025 Microsoft Patch Tuesday shipped 65 updates (KB articles) fixing 144 CVEs, 17 of them rated Critical severity. 4 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

September 202577 CVEs fixed

The September 2025 Microsoft Patch Tuesday shipped 38 updates (KB articles) fixing 77 CVEs, 0 of them rated Critical severity. None from this release were on the CISA KEV exploited list at the time.

August 2025116 CVEs fixed

The August 2025 Microsoft Patch Tuesday shipped 84 updates (KB articles) fixing 116 CVEs, 36 of them rated Critical severity. None from this release were on the CISA KEV exploited list at the time.

July 2025129 CVEs fixed3 exploited

The July 2025 Microsoft Patch Tuesday shipped 51 updates (KB articles) fixing 129 CVEs, 17 of them rated Critical severity. 3 were already being exploited in the wild (on the CISA KEV list) and needed patching first. 3 were linked to ransomware activity.

June 202564 CVEs fixed2 exploited

The June 2025 Microsoft Patch Tuesday shipped 47 updates (KB articles) fixing 64 CVEs, 0 of them rated Critical severity. 2 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

May 202556 CVEs fixed5 exploited

The May 2025 Microsoft Patch Tuesday shipped 34 updates (KB articles) fixing 56 CVEs, 0 of them rated Critical severity. 5 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

April 2025107 CVEs fixed1 exploited

The April 2025 Microsoft Patch Tuesday shipped 35 updates (KB articles) fixing 107 CVEs, 0 of them rated Critical severity. 1 was already being exploited in the wild (on the CISA KEV list) and needed patching first. 1 was linked to ransomware activity.

March 202552 CVEs fixed7 exploited

The March 2025 Microsoft Patch Tuesday shipped 33 updates (KB articles) fixing 52 CVEs, 0 of them rated Critical severity. 7 were already being exploited in the wild (on the CISA KEV list) and needed patching first. 1 was linked to ransomware activity.

February 202545 CVEs fixed2 exploited

The February 2025 Microsoft Patch Tuesday shipped 25 updates (KB articles) fixing 45 CVEs, 0 of them rated Critical severity. 2 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

January 2025148 CVEs fixed3 exploited

The January 2025 Microsoft Patch Tuesday shipped 47 updates (KB articles) fixing 148 CVEs, 15 of them rated Critical severity. 3 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

December 202469 CVEs fixed1 exploited

The December 2024 Microsoft Patch Tuesday shipped 45 updates (KB articles) fixing 69 CVEs, 23 of them rated Critical severity. 1 was already being exploited in the wild (on the CISA KEV list) and needed patching first.

November 202478 CVEs fixed2 exploited

The November 2024 Microsoft Patch Tuesday shipped 35 updates (KB articles) fixing 78 CVEs, 9 of them rated Critical severity. 2 were already being exploited in the wild (on the CISA KEV list) and needed patching first. 1 was linked to ransomware activity.

October 2024104 CVEs fixed4 exploited

The October 2024 Microsoft Patch Tuesday shipped 72 updates (KB articles) fixing 104 CVEs, 34 of them rated Critical severity. 4 were already being exploited in the wild (on the CISA KEV list) and needed patching first. 1 was linked to ransomware activity.

September 202471 CVEs fixed4 exploited

The September 2024 Microsoft Patch Tuesday shipped 45 updates (KB articles) fixing 71 CVEs, 1 of them rated Critical severity. 4 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

August 202471 CVEs fixed6 exploited

The August 2024 Microsoft Patch Tuesday shipped 49 updates (KB articles) fixing 71 CVEs, 15 of them rated Critical severity. 6 were already being exploited in the wild (on the CISA KEV list) and needed patching first.

July 202449 CVEs fixed1 exploited

The July 2024 Microsoft Patch Tuesday shipped 32 updates (KB articles) fixing 49 CVEs, 0 of them rated Critical severity. 1 was already being exploited in the wild (on the CISA KEV list) and needed patching first.

Trusted Patch Tuesday resources

The analyses the security community reads each month. Cross-reference these with the ranked view above.

Microsoft Security Update GuideThe authoritative source: every CVE Microsoft fixed this month, affected products, and KBs.
CISA Known Exploited VulnerabilitiesThe U.S. catalog of CVEs confirmed exploited in the wild. Patch these first.
Zero Day Initiative: Security Update ReviewIn-depth monthly analysis from the researchers behind Pwn2Own.
Tenable Patch Tuesday analysisMonthly breakdowns of the CVEs that matter and why.
Rapid7 Patch TuesdayPatch Tuesday roundups with exploitation and attacker context.
Qualys Threat ResearchPatch Tuesday roundups and prioritization guidance.
SANS Internet Storm CenterCommunity Patch Tuesday dashboard and per-CVE detail.
CrowdStrike Patch Tuesday analysisMonthly Patch Tuesday breakdowns with adversary and exploitation context.
Krebs on SecurityPlain-English monthly Patch Tuesday coverage.
BleepingComputerNews coverage of each Patch Tuesday and emerging exploits.

Frequently asked questions

What is Patch Tuesday?

Patch Tuesday is the second Tuesday of each month, when Microsoft releases its scheduled security updates across Windows, Office, Exchange, SharePoint, and the rest of the Microsoft 365, Intune, Defender, and Entra ID stack. Out-of-band updates ship between Patch Tuesdays when a fix cannot wait, and this page covers both. Senserva ranks each release by what attackers are actually exploiting, ties every CVE to the KB that fixes it, and, in your own tenant, tells you which of these updates are actually missing on your devices.

When is the next Patch Tuesday?

The next Microsoft Patch Tuesday is October 13, 2026. It falls on the second Tuesday of every month; upcoming dates are listed on this page.

What was in the latest Patch Tuesday?

The September 2026 release included 60 updates (KBs) fixing 1,169 CVEs, of which 2 are actively exploited (CISA KEV). The exploited CVEs, the highest-risk CVEs, and the full history are on this page.

Which Patch Tuesday updates should I install first?

Install the actively-exploited (CISA KEV) fixes first, then the highest EPSS and CVSS ones, then the rest. This page ranks every release that way, and Senserva applies the same order to the updates actually missing on your own devices.

What is a zero-day on Patch Tuesday?

A zero-day is a vulnerability already being exploited (or publicly disclosed) before a patch was available. Those are the CVEs to patch immediately; this page calls out the actively-exploited ones each month.

How often is this page updated?

Automatically, every day. The data refreshes from Microsoft MSRC, CISA KEV, and FIRST.org EPSS, and the month-by-month history is preserved so the archive only grows.

Is this Patch Tuesday tracker free?

Yes, free with no sign-in. Running Senserva adds the part a public page cannot: which of these updates are actually missing on your devices, ranked, so you fix the right things first.

Can I use this Patch Tuesday data with my own AI?

Yes. A free copy-paste AI prompt just under the exploited-CVE list is composed from this release: the update and CVE counts, and the actively-exploited CVE names with their CVSS scores. Paste it into Claude, ChatGPT, or Copilot to get a first-24-hours plan and a team briefing in your own words.

The Microsoft CVE and patch resource center

Everything here is free, refreshed twice a day (morning and afternoon US Central), and cross-linked. Start with this month, then drill into any CVE, KB, product, or month since tracking began.

Microsoft patch trackerEvery KB and the CVEs it fixes, searchable and ranked by CISA KEV and EPSS.CVE and vulnerability managementThe plain-English Microsoft CVE reference: what to fix first and why.Actively exploited (CISA KEV)The third-party vulnerabilities attackers are using right now, EPSS-ranked.Open source patch trackerExploited and high-risk CVEs across the open-source stack.End of life trackerSoftware and Windows versions running past their support dates.Patch Tuesday historyEvery release since tracking began, charted, with plain-English month recaps.

Data access: Patch Tuesday RSS · JSON patch API · calendar (.ics). Plus a page for every CVE and KB, linked throughout. JSON and RSS feeds included, no login required: all feeds and the API.

AI patch management: put your own AI on this data

Now see your own patch state.

Senserva reads your Microsoft 365, Intune, Defender, and Entra ID environment and turns this release into your list: every update still missing, on every device, ranked by what attackers are actually exploiting. The 650+ configuration checks come with it.

1Find it2Fix it3Prove it
Start my free patch auditAll you do is register.

Reference: the Microsoft patching guide, how Intune, Windows Autopatch, Defender, and Azure Update Manager fit together, and where third-party patch vendors fit in.

Data notice: this page, the feeds, and the API are provided as is, for informational purposes only, without warranty of any kind. Senserva, LLC does not guarantee the accuracy, completeness, or timeliness of third-party data and accepts no liability for actions taken based on it; verify against the primary source before acting. All use of this data is subject to the Senserva EULA.

Patching across Intune, Windows Autopatch, Defender, Azure, and your endpoint managers: see Senserva patching in action.