September Patch Tuesday: 963 CVEs, 2 exploited flaws, 1 message

Microsoft's September 2026 Patch Tuesday is the largest release of the year, with 963 CVEs requiring customer action and 106 rated critical. Two of these vulnerabilities have already been exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Advanced Local Procedure Call. No vulnerabilities were disclosed ahead of the patch.

The Readiness team recommends a Patch Now scheduling for Windows, Office, SQL Server, and developer tooling, and a standard patch release for Exchange. The team has published an infographic summarizing deployment risk by product family. Three client issues carried over from August include Microsoft Teams and the new Outlook failing to launch on ARM devices, solid black desktop backgrounds reverting, and mouse cursor customisation resetting on non-English installations.

These issues were resolved by KB5124008. Microsoft has left open a Microsoft Defender Antivirus notification defect, affecting devices that report Defender as turned off while it is running correctly. The quietest revision window of recent months accompanied the largest release, with 324 CVEs touched between August and September.

Only one of the 17 entries affecting Microsoft's own products is a genuine revision. Microsoft has published no mitigations or workarounds for any of the 963 updates. Windows lifecycle and enforcement updates will see several end-of-support notices in October, including the retail Office 2021 family, Office LTSC 2021, Windows 10 2016 LTSB and IoT Enterprise LTSB 2016, and Windows Server 2012 and 2012 R2.

Microsoft's test guidance for this release focuses on printing, fonts, graphics and imaging, USB devices, device association, and storage. The Readiness team recommends prioritizing testing for these areas due to the large number of updates this month.