Microsoft Sets a New Record in September Patch Tuesday With 974 Vulnerabilities Fixed

Microsoft's September 2026 Patch Tuesday update set an all-time record, fixing between 972 and 974 vulnerabilities across its software portfolio, including more than 110 flaws classified as critical and 20 "wormable" bugs. The issues fixed include two zero-day vulnerabilities actively exploited in real-world attacks. One of these is CVE-2026-69414 (known as ShieldBreak), a privilege escalation vulnerability in Microsoft Defender. Just hours after the release, a researcher using the pseudonym Chaotic Eclipse published a Proof-of-Concept exploit called ShieldCrash, demonstrating that the original patch can be bypassed to read arbitrary files with system-level (SYSTEM) privileges on all supported versions of Windows. This rapid demonstration highlights the persistent challenges defenders face in ensuring complete mitigation amid such massive patch releases.

Source: CrowdStrike Blog