Patch Tuesday 2026: Record Fixes, Zero-Days and Next Dates

Patch Tuesday in 2026: the short answer

Patch Tuesday is still Microsoft's monthly security update day, the second Tuesday of each month.[5] In 2026 it is bigger than ever. The September 8, 2026 release fixed more than 960 vulnerabilities, a record, including two zero-days that attackers were already using.[6][7] The next Patch Tuesday is October 13, 2026.

Our original 2017 report below covers a very different moment: Microsoft skipped February 2017 and then shipped 18 security bulletins in March.[1][2] Microsoft no longer uses that bulletin format, and today one release can carry hundreds of CVE fixes. The advice has not changed. Install the updates soon, and install exploited zero-day fixes first.

Timeline: Patch Tuesday from 2017 to 2026

What changed since 2017

The scale is the first change. In March 2017, 18 bulletins covering about 150 fixes felt huge.[2] In September 2026, CrowdStrike counted 972 CVEs, more than double the August count, and Malwarebytes called it the largest Patch Tuesday on record.[6][7] Different vendors count slightly differently, so totals vary by a few entries.

The second change is speed. Help Net Security describes a new pattern in which an anonymous researcher publishes a zero-day proof of concept hours after Microsoft ships its fixes.[8] In September 2026 that was ShieldCrash, which reportedly bypasses an earlier fix for a privilege escalation bug in Microsoft Defender.[8] The gap between patch day and attack day keeps shrinking.

The exploited bugs also changed shape. Both September 2026 zero-days let a low-privileged attacker gain SYSTEM rights. CVE-2026-81963 hit the Windows Update Stack in Windows 11 and Windows Server 2025, and CVE-2026-85880 hit Windows ALPC in Windows 10 and older servers.[8] Tenable's Satnam Narang noted it was the first exploited zero-day in the Windows Update Stack.[8]

Risks and scams around Patch Tuesday (our analysis)

• Fake update emails. Messages that say "install the urgent Microsoft patch" with an attached file or link. Microsoft delivers updates through Windows Update, not by email.
• Fake update pop-ups in the browser. A web page that claims Windows is out of date and offers a download is a scam. Our virus removal guides cover these fake alerts.
• Unpatched Windows 10. Machines without ESU stop getting fixes, while 2026 zero-days still hit Windows 10.[8][9]
• Delayed restarts. Many updates only apply after a reboot. A PC that has not restarted for weeks may still be unprotected.

How to handle Patch Tuesday safely

1. Check Windows Update. On the second Tuesday of the month, open Settings and check for updates. The next date is October 13, 2026.

2. Restart the PC. Install, then reboot. Fixes for the Windows Update Stack itself, like CVE-2026-81963, matter here.[8]

3. Patch zero-days first. In a business, roll out fixes for exploited flaws before routine ones. September 2026 had two.[6]

4. Update other Microsoft apps. Office and server products such as SharePoint also get fixes on Patch Tuesday.[8] Turn on automatic updates where you can.

5. Plan for Windows 10. Enroll in Extended Security Updates, which Microsoft offers to consumers until October 12, 2027, or move to a supported system.[9]

6. Ignore fake updates. Never run an update file from an email or a pop-up. Report such messages using our guide on how to report phishing.

What is still unknown

• How many CVEs the October 13, 2026 release will fix. Microsoft does not announce totals in advance.
• Whether record-size releases will continue. Help Net Security expects a return to a typical cadence over time, but gives no date.[8]
• Whether Microsoft will fully fix the ShieldCrash bypass in October. We found no statement as of October 7, 2026.

Our original 2017 report

The text below is our report as first published in 2017. We keep it unchanged for the record; the sections above bring it up to date.

After two months break,[1] the Patch Tuesday is back and even bigger than expected. Microsoft released 18 bulletins that include important and critical security updates.[2] Almost 150 updates are designed to fix vulnerabilities in various Microsoft products, such as Internet Explorer and Edge web browsers, Microsoft Office, Adobe Flash Player, and other Windows services. The biggest attention is devoted to the critical updates that resolve issues that might allow cyber criminals to use remote code execution (RCE)[3] in order to get administrative rights to the computer. What is interesting, that other vendors have already disclosed some of these vulnerabilities.[4] Though, Microsoft deserves some compliments for acting quickly and solving these issues with their products.

The biggest attention is dedicated to four critical bulletins – MS17-006, MS17-007, MS17-012, and MS17-013. Cumulative security updates for Internet Explorer (MS17-006) and Microsoft Edge (MS17-007) resolves the issue with remote code execution (RCE). Using these vulnerabilities, cyber criminals could get administrative access to the computer. This problem might arise any time when user visits infected or crafted website with the outdated web browser. Thus, users should update these browsers immediately in order to avoid possible damage. What is more, these two browsers have built-in Adobe Flash Player, and the attackers often use this application for their dirty job. However, Microsoft also released a critical update for the Adobe Flash Player (MS17-023) to fix vulnerabilities in this product.

Windows operating system had many flaws and issues with security. Thus, in order to make OS safer, Microsoft released a security update for Microsoft Windows (MS17-012). Using flaws in Windows operating system cyber criminals might get full access to the attacked computer by using particular malicious applications that allow connecting to an iSNS Server. The company also identified and fixed vulnerabilities in Microsoft Graphics Component (MS17-013). This bulletin resolves issues in Microsoft Windows, Microsoft Office, Skype for Business, Microsoft Lync, and Microsoft Silverlight. Vulnerabilities might also allow remote code execution for the cyber criminals in several ways. For instance, when a user visits a malicious website or opens an infected document, the attackers might get access to the computer. What is more, Microsoft also released a security update for Microsoft Office (MS17-014). Nevertheless, this bulletin is marked as "important" it still can allow attackers to access remote code execution. Hopefully, this patch will make ransomware distribution more complicated. Developers of the file-encrypting viruses often use crafted Word documents to install and activate malware executable.

Patch Tuesday[5] is an unofficial name for the monthly update release from Microsoft. The company releases patches for their software on the second (or forth) Tuesday each month since 2003. However, on February 2017, Microsoft delayed the release for the first time. Thus, the March patch was expected to be huge and surpassed the expectations. Microsoft users are encouraged to install latest updates immediately. Outdated software might lead to malware or virus attacks and cause lots of problems from data loss to identity theft.

Related guides on 2-Spyware

• Virus and malware removal guides
• How to report phishing
• Recent data breaches
• Check whether your email appeared in a leak