Microsoft releases patches for nearly 1,000 vulnerabilities, including zero-days

Microsoft has released its September 2026 security updates, addressing nearly 1,000 vulnerabilities across its software ecosystem, including Windows, Office, Azure, and Copilot-branded AI products. The update includes fixes for 964 distinct CVEs, with 112 rated as critical.

Notably, the release addresses two zero-day vulnerabilities that were already being exploited in the wild: a Print Spooler elevation-of-privilege flaw and an Office VBA remote code execution vulnerability. The latter has been observed delivering ransomware via phishing documents. Other significant fixes target Azure services, including container escape vulnerabilities in Azure Kubernetes Service and information disclosure flaws in Microsoft 365 Copilot and Azure Machine Learning.

While many Azure-related fixes were implemented on the server side and do not require customer action, users must manually update Windows to resolve a privilege escalation vulnerability (CVE-2026-85921). Security researchers have noted a surge in vulnerability discovery, partly driven by the increased use of advanced AI technologies.