Microsoft's September Patch Tuesday Delivers 973 Fixes, With Windows Taking the Lion's Share

Microsoft released 973 patches affecting 39 product families on September 9, according to Sophos. Of these, 114 are rated Critical by Microsoft, and 284 have a CVSS base score of 8.0 or higher. Microsoft expects 58 of the issues to be exploited within the next 30 days, and two Important-severity Windows vulnerabilities are already being exploited. None of the flaws were publicly disclosed before the patches arrived.

Nine of the CVEs were fixed before September 9 and are treated as advisories. All nine are Critical, and two carry a maximum 10.0 score. They affect cloud and AI services including Azure, Copilot, Entra, Fabric and Power Automate. Sophos notes that the average administrator does not need to act on them. Other items in the wider set include 24 Edge-related patches, 21 Adobe Acrobat fixes, and an OpenSSL advisory, CVE-2026-34182, which carries a 9.1 CVSS score and concerns improper validation of an integrity-check value in certain CMS data containers.

On October 2, Microsoft re-released the September set with one addition: CVE-2026-96940, an Important-severity elevation of privilege flaw (CVSS 8.8, weak authentication) affecting Exchange Server Subscription Edition, plus Exchange Server 2016 and 2019 for customers in the Period 2 Extended Security Update program. Microsoft's Exchange team has published details, including known issues to be resolved in a future update.