September 2026 Windows Update — 974 Fixes, 2 Zero-Days, Install It Now
Microsoft shipped 974 security fixes on 8 September. That is not a typo. Nearly a thousand vulnerabilities in a single update, smashing July's record of 570. A hundred and thirteen are rated Critical. Two are already being exploited. Install now, read on after.
The two zero-days
Both are privilege escalation. An attacker who already has a foothold on your machine can use either one to gain full SYSTEM access. Complete control.
2 zero-days, actively exploited
"Already on the machine" sounds less scary than remote code execution. But phishing emails, dodgy downloads and browser exploits hand out that initial foothold every single day. Don't sit on this one.
Three other flaws worth knowing
- CVE-2026-78509, Outlook. A crafted email runs code the moment Outlook displays it in the preview pane. No clicking, no opening attachments. CVSS 9.8. This isn't the only one: twelve Office vulnerabilities this month can be triggered through a preview pane.
- CVE-2026-69579, MSMQ. Remote code execution over the network, no login required. Mostly business systems running Message Queuing, but anyone exposed on TCP 1801 is at risk.
- CVE-2026-69730, DNS Server. Wormable. Being compared to 2020's SigRed. Could spread between DNS servers automatically with no human involvement.
That Outlook flaw is the one I'd flag for home users. If your email client auto-previews the top message in your inbox, the exploit fires the second Outlook opens. You don't have to click a thing.
Why nearly a thousand?
AI-assisted vulnerability discovery. Security researchers are using tools that scan millions of lines of code for patterns humans would take weeks to spot. 2026's total is already past 2,600 CVEs, more than double any previous full year. July hit 570. September, 974.
Anything broken?
No widespread problems reported with this update so far. It also fixes some bugs from August: the mouse cursor customisation issue on non-English systems, random black desktop backgrounds, and Teams crashing on ARM laptops.
How to install
- Settings > Windows Update
- Check for updates
- Wait 10-30 minutes
- Restart when prompted, not two days later
KB5124008 (24H2 and 25H2). Look in Update history to confirm it's installed.
Windows 10 (if you're still there)
This month's Windows 10 patch is KB5122878. You only get it through the free Extended Security Updates programme. See the Windows 10 end-of-life guide for how to enrol. Free ESU runs until October 2026. One month away.
If Windows Update itself is broken
A PC that can't update can't protect itself. The usual culprits are low disk space, corrupted update files, or another antivirus clashing with Defender. I've covered the fixes in my common PC problems post. If storage is the bottleneck, speeding up a slow Windows 11 PC has that covered too. If none of that works, computer repair in St Helens is what I do.
If you want the full technical breakdown, Bleeping Computer covers every CVE and Krebs on Security analyses which ones matter most.
Mark has been fixing computers since the late '90s and went self-employed in 2008. Based in St Helens since 2013, he works evenings and weekends from his home in Laffak — friendly, affordable repairs for PCs, laptops, and Macs. See reviews on Google
Updates failing or something not right?
If Windows Update is stuck, your PC is running worse since you installed, or you're not sure you're protected — get in touch and I'll sort it.
★★★★★"I cant fault this guy. Fit me in speedily and resolved the issue. Had another issue once I got home and he did fixed that too. Would defo use again."
— Melanie Atherton, via Google