September 2026 vulnerabilities

Microsoft reports 2 vulnerabilities with exploitation detected in the wild this month. This defender-focused view covers 3,860 vulnerabilities across 9,413 returned patch records from 4 vendors. Filter the month to date, or browse the static page trail without JavaScript.

Patch records

Returned Microsoft and cross-vendor release records. One Common Vulnerabilities and Exposures (CVE) identifier can appear in more than one record.

Tracked here

Records joined to a vulnerability record in this tracker.

Defender priority

Sorts Microsoft exploitation status, Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog status, severity, and tracker coverage first.

More likely

Microsoft's Exploitability Index rating that exploitation is more likely. It is not a claim that exploitation was detected.