Patch Tuesday
Microsoft's scheduled monthly security update release on the second Tuesday.
Microsoft's 8 September 2026 Patch Tuesday fixed 973 Microsoft-assigned flaws, 113 rated Critical, the largest monthly count since at least January 2025. Microsoft listed only two of them as already under attack.
Last refreshed: 12 October 2026
Why did September 2026 Patch Tuesday fix 973 flaws at once?
Timeline for Patch Tuesday
Named as Patch Tuesday
Cybersecurity: Threats and Defences: Mentioned in: Microsoft fixes 973 flaws in one releaseMentioned in: Microsoft ends the Nightmare Eclipse run
Cybersecurity: Threats and DefencesMentioned in: Splunk lands its first-ever KEV entry
Cybersecurity: Threats and DefencesMentioned in: A handle keeps dropping MS zero-days
Cybersecurity: Threats and DefencesMentioned in: 200 fixes, six zero-days, late Exchange
Cybersecurity: Threats and DefencesBackground
Patch Tuesday, sometimes called Update Tuesday, falls on the second Tuesday of each month, when Microsoft releases its scheduled security fixes. Microsoft set the cadence in October 2003. The fixed date gives administrators a known window to test updates and plan changes.
Microsoft does not hold every fix for that date. Serious flaws under active attack get out-of-band patches, which then fold into the next monthly release. The May 2026 release contained no zero-day already being exploited, breaking a sequence that ran back to July 2024, yet two out-of-band entries reached CISA's exploited list within 48 hours.
Release sizes swing widely. September 2026 brought 973 fixes against a previous high of 571 in July 2026, while US agencies got 14 days for the two exploited Windows privilege flaws.