Microsoft’s September 8, 2026 Patch Tuesday release covers 1,239 CVEs: 118 rated critical, 924 rated important, and 125 rated moderate (72 carry no severity classification in Microsoft’s own data). Four of the 1,239 are listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog as actively exploited.
Correction, 2026-09-13: an earlier version of this article reported 8 vulnerabilities for this release. That figure was an artifact of our own ingestion pipeline’s per-run processing cap, not the true release size — it never reflected MSRC’s actual data. This version is rebuilt from the complete MSRC CVRF document for September 2026.
What’s actually in this release
MSRC’s monthly security-update document isn’t a single homogeneous list — it mixes three genuinely distinct categories, and treating the raw total as one undifferentiated “Patch Tuesday count” (as security media coverage typically does) obscures what’s actually new this month:
| Category | Count | What it is |
|---|---|---|
| Core Microsoft bulletins | 992 | Windows, Office, Exchange, Entra ID, Azure services — genuine, individually-titled product vulnerabilities |
| Azure Linux (Mariner) OS packages | 220 | Open-source package vulnerabilities bundled into Microsoft’s Azure Linux distribution image, largely inherited from upstream disclosures, not new-this-month Microsoft-authored bulletins |
| Microsoft Edge (Chromium) | 27 | Individual upstream Chromium security fixes re-published under Edge’s advisory title |
Severity breakdown
| Severity | Count |
|---|---|
| Critical | 118 |
| Important | 924 |
| Moderate | 125 |
| Unclassified in source data | 72 |
| Actively exploited (CISA KEV) | 4 |
Actively exploited vulnerabilities
All four CVEs below are listed in CISA’s KEV catalog as of September 8, 2026:
| CVE | Title | CVSS |
|---|---|---|
| CVE-2026-81963 | Windows Update Stack Elevation of Privilege Vulnerability | 7.8 |
| CVE-2026-85880 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | 7.8 |
| CVE-2026-85046 | Chromium: Type Confusion in V8 | — |
| CVE-2026-87491 | Chromium: Out of Bounds Write in V8 | — |
Both Windows CVEs are local elevation-of-privilege flaws in core OS components (the Update Stack and ALPC) — the kind of vulnerability typically chained with a separate initial-access exploit rather than used alone. The two Chromium CVEs affect Edge’s underlying V8 engine; Microsoft’s CVRF data doesn’t carry a separate CVSS score for these since NVD/Google score them upstream.
Highest-severity core bulletins
The 992-CVE core bulletin set spans the full range of Microsoft’s product line. The highest-scored entries by CVSS:
| CVE | Title | CVSS |
|---|---|---|
| CVE-2026-70352 | Azure AI Language Elevation of Privilege Vulnerability | 10.0 |
| CVE-2026-83711 | Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability | 10.0 |
| CVE-2026-83941 | Entra ID Elevation of Privilege Vulnerability | 9.9 |
The three highest-scored CVEs this month are all cloud-identity vulnerabilities (Azure AI Language, Azure AD B2C, Entra ID) rather than traditional on-premises Windows components — consistent with Microsoft’s continued shift of critical-severity findings toward its Azure/Entra identity stack.
Why this matters
The two actively-exploited Windows elevation-of-privilege CVEs (CVE-2026-81963, CVE-2026-85880) warrant immediate patching for any exposed Windows fleet — CISA KEV listing means exploitation is confirmed, not theoretical. The three CVSS 9.9–10.0 cloud-identity vulnerabilities deserve equally fast attention from organizations running Azure AI Language, Azure AD B2C, or Entra ID, even though none are yet KEV-listed, given the blast radius of an identity-layer compromise.
The Azure Linux/Mariner OS-package entries (220 of the 1,239) should be tracked through normal container/VM image update cycles rather than treated as urgent standalone advisories — they’re real vulnerabilities, but Microsoft remediates them through a distro image upgrade, not a per-CVE patch.
Frequently Asked Questions
How many vulnerabilities did Microsoft patch in September 2026? 1,239, per Microsoft’s September 8, 2026 Patch Tuesday CVRF release — 992 core Microsoft product bulletins, 220 Azure Linux (Mariner) OS-package entries, and 27 Microsoft Edge (Chromium) fixes.
Were any September 2026 Patch Tuesday vulnerabilities actively exploited? Yes — four are listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog as of September 8, 2026: CVE-2026-81963, CVE-2026-85880 (both Windows elevation-of-privilege flaws), and CVE-2026-85046, CVE-2026-87491 (both Chromium/Edge V8 engine flaws).
Why did this article originally say “8 vulnerabilities”? That number came from an internal processing limit in our own data pipeline, not from Microsoft’s actual release data. It has been corrected — see the note at the top of this article.
Data sourced from Microsoft Security Response Center (MSRC) CVRF v3.0 and CISA’s Known Exploited Vulnerabilities (KEV) catalog, aggregated September 13, 2026. See more vulnerability research.