← Back to Feed
September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs
September 8, 2026 · CrowdStrike · Severity: CRITICAL
CrowdStrike's Patch Tuesday analysis for September 2026 reveals that Microsoft patched 972 CVEs, including two exploited zero-days and 113 critical vulnerabilities. The breakdown by exploitation technique shows 437 elevation of privilege patches (45%), 258 RCE patches (26%), and 171 information disclosure patches (18%). Microsoft Office received 22 critical patches, of which 12 are exploitable via Preview Pane. Organizations should prioritize the two actively exploited zero-days for immediate remediation.
Key Takeaways
- Active exploitation detected — patch immediately to prevent compromise
- Affected systems should be identified and prioritized for remediation
- Monitor for additional indicators of compromise as investigations evolve