Microsoft shipped 996 fixes this month, 132 of them rated Critical. A further 1019 entries in the same document are third-party CVEs Microsoft republishes or Edge/Chromium updates, carrying 28 Critical — counted separately here, because that total tracks Microsoft's role as a CNA rather than the size of Patch Tuesday. 4 are already under active attack and should be patched today; 0 publicly disclosed zero-days should be closed this week. Everything else fits the normal monthly cycle.
Mid-month checkpoint. First published 2026-09-09 15:42 UTC (MSRC revision 222); updated 2026-09-24 15:12 UTC against MSRC revision 2510 and the current CISA KEV catalog. Blog corroboration and the webinar slide tiers carry over from first publish and were not re-fetched; the October cycle gets a fresh pass.
As of 2026-09-24 15:12 UTC, this cycle’s MSRC document lists 2,015 CVEs — 996 Microsoft-authored, plus 287 Edge/Chromium and 732 Linux/other entries that are republished third-party fixes patching through their own vendors. That figure is a reading at a timestamp, not a fixed total for the month: Microsoft revises this document in place, and it is currently at revision 2510 (last revised 2026-09-24 02:47 UTC). The two Critical lines above are kept separate for the same reason — the third-party total moves with Microsoft’s CNA scope, not with the size of Patch Tuesday.
Confirmed in CISA KEV and flagged as exploited by Microsoft. Treat as active incidents, not routine patching.
in CISA KEV (added 2026-09-08); MSRC Exploited; ⬆ HCL: flagged dangerous. Owner routes to the Other / general Windows team.
in CISA KEV (added 2026-09-08); MSRC Exploited. Owner routes to the Other / general Windows team.
in CISA KEV (added 2026-09-04). Owner routes to the Browser (Edge auto-update) team.
in CISA KEV (added 2026-09-09). Owner routes to the Browser (Edge auto-update) team.
Publicly disclosed but not yet observed in the wild — a zero-day on a countdown. Schedule ahead of the normal cycle.
None this month.
This month's priority items grouped by the team that patches them.
Ordered by a composite priority that weights active exploitation and disclosure above raw CVSS. Showing the sharp end; the full ranked set of 2,015 CVEs is in the index.
| CVE | Status | CVSS | Impact | Owner |
|---|---|---|---|---|
| CVE-2026-81963 | Exploited | 7.8 | Elevation of Privilege | Other / general Windows |
| CVE-2026-85880 | Exploited | 7.8 | Elevation of Privilege | Other / general Windows |
| CVE-2026-85046 | Exploited | — | — | Browser (Edge auto-update) |
| CVE-2026-87491 | Exploited | — | — | Browser (Edge auto-update) |
| CVE-2026-62874 | Critical | 10.0 | Elevation of Privilege | Cloud / M365 apps |
| CVE-2026-69399 | Critical | 10.0 | Elevation of Privilege | Cloud / M365 apps |
| CVE-2026-69843 | Critical | 10.0 | Elevation of Privilege | Other / general Windows |
| CVE-2026-69865 | Critical | 10.0 | Elevation of Privilege | Other / general Windows |
| CVE-2026-70200 | Critical | 10.0 | Elevation of Privilege | Cloud / M365 apps |
| CVE-2026-70352 | Critical | 10.0 | Elevation of Privilege | Cloud / M365 apps |
| CVE-2026-83711 | Critical | 10.0 | Elevation of Privilege | Identity / AD |
| CVE-2026-83944 | Critical | 10.0 | Elevation of Privilege | Cloud / M365 apps |
| CVE-2026-85889 | Critical | 10.0 | Elevation of Privilege | Cloud / M365 apps |
| CVE-2026-83941 | Critical | 9.9 | Elevation of Privilege | Other / general Windows |
| CVE-2026-85878 | Critical | 9.9 | Elevation of Privilege | Cloud / M365 apps |
Plus further Critical-severity items this cycle — browse and filter them all in the index.
The items on the sharp end, with attack profile and cross-source context.
↑ Corroborated — HCL BigFix field analysts independently flagged this item in their published briefing.
↑ Corroborated — HCL BigFix field analysts independently flagged this item in their published briefing.
↑ Corroborated — HCL BigFix field analysts independently flagged this item in their published briefing.
↑ Corroborated — HCL BigFix field analysts independently flagged this item in their published briefing.
Authoritative counts and exploitation flags come from Microsoft's MSRC Security Update Guide and CISA's Known Exploited Vulnerabilities catalog. Independent reporting and analyst commentary corroborate and add context but do not set priority.
Ranking is a composite score that weights active exploitation and public disclosure above raw CVSS, adjusted for network-reachable / no-authentication attack profiles and field-analyst judgment — which is why a low-CVSS vulnerability under active attack can outrank an unexploited 9.8.