September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs
Refract AI Intelligence Digest
BLUF
Immediate patching is mandatory due to two zero-day vulnerabilities currently under active exploitation.
NEWS
The September 2026 update covers 972 CVEs with 113 rated as critical severity. CrowdStrike analysis confirms that two of these flaws are being weaponized by threat actors prior to public disclosure.
Why I Care
Organizations running unpatched Windows systems are at immediate risk of compromise, potentially leading to lateral movement, data exfiltration, or ransomware deployment.
Next Steps
Security teams must prioritize deploying patches for the two exploited zero-days within 24 hours and schedule all critical updates within the standard 48-hour maintenance window.
Source: CrowdStrike Blog ·