Patch Tuesday September 2026: the biggest patch month on record

On 8 September 2026, Microsoft shipped fixes for 966 vulnerabilities in a single Patch Tuesday release. That is the largest monthly update Microsoft has ever published, well clear of July’s 570 and August’s 400. Two of the flaws were already being exploited before the patches existed.

Numbers like that can read as alarming. They should read as a workload question instead. Nothing about September changes what good patching looks like; it changes how much of it there is to do, and how quickly the important pieces need to move.

What was in the September release

Of the 966 fixes, 105 were rated critical, and 81 of those were remote code execution flaws, the kind that let an attacker run their own code on your systems. The release touched most of the Microsoft estate a business relies on: Windows itself, Office, Active Directory services, .NET and Azure components.

The two vulnerabilities that matter most this month are the zero-days, both affecting Windows and both exploited in the wild before the fix shipped. CVE-2026-81963 sits in the Windows Update stack and lets an attacker who already has a foothold elevate themselves to SYSTEM, the highest level of access on the machine. CVE-2026-85880 is a similar elevation flaw in a core Windows component called ALPC. Neither lets an attacker in from the outside on its own. Both make a small intrusion much worse, which is exactly how most serious incidents unfold.

Why the monthly numbers keep climbing

Industry reporting attributes much of the increase to Microsoft’s use of AI-driven tooling to find vulnerabilities in its own products. More flaws found internally means more fixes shipped per month, and it means the months ahead will probably look more like September than like the quieter releases of past years.

This is better news than it sounds. A vulnerability found by Microsoft and patched on schedule is a vulnerability an attacker has to race to use. The trade-off lands on businesses: patch cycles that were comfortable at 100 fixes a month need to hold up at close to 1,000.

What to do about it this month

If your systems are managed and patching is automated, the September updates should already be flowing through a test group and out to the fleet. Worth confirming rather than assuming. If patching at your business is manual, or nobody is quite sure who owns it, this is the month to fix that, and the two zero-days are the reason to move quickly.

The order of work is straightforward. The zero-days and the critical remote code execution fixes go first, because attackers reverse-engineer patches within days of release and build exploits for the machines that have not caught up. Everything else follows through a normal deployment window that does not disrupt the business. The Microsoft Learn documentation covers the mechanics for administrators; the judgment calls about sequencing and exceptions are where most businesses need a hand.

One unglamorous detail decides more outcomes than any tooling choice: restarts. A patch that is downloaded but waiting on a reboot protects nobody, and a fleet can show green in the update console while half its machines sit in that state for weeks. Whatever your process is, it needs a step that confirms updates are installed and active, machine by machine, rather than merely offered.

The bigger picture for Australian businesses

Patching applications and operating systems are two of the ACSC’s Essential Eight controls, and the maturity model behind them expects actively exploited vulnerabilities to be patched within 48 hours. September is a useful test of whether your business could actually meet that bar. A month with two exploited zero-days and nearly a thousand fixes is what the Essential Eight was written for.

It is also a reasonable moment to check the basics around patching. Machines that never restart do not finish installing updates. Laptops that live off the network miss deployment windows. Old machines running out-of-support software collect vulnerabilities that no Patch Tuesday will ever fix. None of this is glamorous work, and all of it decides whether a record patch month protects you or passes you by.

A short check

• Were the September zero-day fixes installed across your fleet within days of release, and can someone show you the report that proves it.
• Does patching at your business follow a schedule, or does it happen when someone remembers.
• Do you know which of your machines are running software too old to receive patches at all.
• Would your patch cycle meet the Essential Eight’s 48-hour expectation for exploited vulnerabilities.

If any of those answers are uncomfortable, the fix is a process rather than a heroic catch-up weekend. We keep a running list of Patch Tuesday dates so the schedule is never a surprise, and for clients on our Done-for-You IT service, months like September are handled as routine: tested, deployed and reported without anyone at the business lifting a finger.

How do we get started?

If September’s numbers have you wondering whether your patching would hold up, that is a conversation worth having this month rather than next. Get in touch and we will take an honest look together.