IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Patch Tuesday

What Microsoft fixes on the second Tuesday of every month – straight from the official Security Update Guide: number of vulnerabilities, critical and already exploited ones (zero-days), affected products and the history of the last 24 months.

998vulnerabilities fixed (CVEs)
131of them critical
2exploited (zero-day)
0publicly disclosed
Tue, 10 Nov 2026Next Patch Tuesday
in 10 days and 1 hours

Patch Tuesday September 2026

973 of them published on Patch Tuesday (Tue, 8 Sep 2026), the rest added during the month. The month also contains 1,990 CVEs from other issuers that Microsoft ships in its own products (e.g. Chromium in Edge, Linux in Azure Linux) – they are not counted here. Microsoft Security Update Guide

Already exploited (zero-days)

Critical vulnerabilities (131)

Show 123 more

Exploitation more likely according to Microsoft

Show 24 more

Show all 998 CVEs of this month

By impact

  • Elevation of privilege455
  • Remote code execution260
  • Information disclosure179
  • Denial of service55
  • Spoofing18
  • Security feature bypass18
  • Tampering13

By product family

  • Windows705
  • Microsoft Office142
  • SQL Server62
  • Azure24
  • Developer tools (.NET, Visual Studio …)22
  • Other19
  • Windows ESU (Extended Security Updates)9
  • Apps5

History of the last 24 months

  • Critical
  • High
  • Medium
  • Low
  • exploited (zero-day)
05001,0001,500November 2024: 97 CVE, 7 critical, 3 exploited (zero-day)3Nov 24December 2024: 75 CVE, 19 critical, 1 exploited (zero-day)1January 2025: 165 CVE, 13 critical, 3 exploited (zero-day)3February 2025: 66 CVE, 6 critical, 3 exploited (zero-day)3Feb 25March 2025: 65 CVE, 10 critical, 6 exploited (zero-day)6April 2025: 132 CVE, 17 critical, 1 exploited (zero-day)1May 2025: 80 CVE, 11 critical, 5 exploited (zero-day)5May 25June 2025: 72 CVE, 13 critical, 1 exploited (zero-day)1July 2025: 137 CVE, 17 critical, 1 exploited (zero-day)1August 2025: 116 CVE, 19 critical, 0 exploited (zero-day)Aug 25September 2025: 94 CVE, 13 critical, 0 exploited (zero-day)October 2025: 180 CVE, 18 critical, 2 exploited (zero-day)2November 2025: 71 CVE, 12 critical, 1 exploited (zero-day)1Nov 25December 2025: 65 CVE, 8 critical, 1 exploited (zero-day)1January 2026: 124 CVE, 17 critical, 2 exploited (zero-day)2February 2026: 61 CVE, 7 critical, 6 exploited (zero-day)6Feb 26March 2026: 97 CVE, 19 critical, 0 exploited (zero-day)April 2026: 181 CVE, 23 critical, 2 exploited (zero-day)2May 2026: 162 CVE, 46 critical, 3 exploited (zero-day)3May 26June 2026: 220 CVE, 49 critical, 0 exploited (zero-day)July 2026: 663 CVE, 75 critical, 3 exploited (zero-day)3August 2026: 457 CVE, 84 critical, 1 exploited (zero-day)1Aug 26September 2026: 998 CVE, 131 critical, 2 exploited (zero-day)2October 2026: 1,475 CVE, 94 critical, 1 exploited (zero-day)1Oct 26

Number of Microsoft CVEs per Patch Tuesday by severity; the red dot shows the number of vulnerabilities already exploited. Click a month for the details.

MonthCVECriticalExploited (zero-day)Publicly disclosedHighest CVSS
October 20261,475941110.0
September 20269981312010.0
August 2026457841310.0
July 2026663753110.0
June 2026220490410.0
May 2026162463310.0
April 2026181232110.0
March 202697190210.0
February 2026617639.8
January 202612417219.9
December 20256581210.0
November 202571121010.0
October 2025180182110.0
September 202594130110.0
August 2025116190110.0
July 202513717119.9
June 20257213119.8
May 202580115210.0
April 202513217109.9
March 20256510619.3
February 2025666329.0
January 202516513359.9
December 20247519119.8
November 2024977339.9

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed