Record Patch Tuesday Fixes ~1,000 Windows Flaws, Needs Emergency Update

The September 2026 Patch Tuesday, released by Microsoft on September 8, made history: roughly 1,000 vulnerabilities fixed in one go, the largest volume the company has ever shipped. A week later, on September 15, came the second half of the story — an out-of-band emergency update to fix problems the original package introduced.

Quick answer: what happened?

Microsoft patched approximately 1,000 security flaws across Windows and related products in the September 8 Patch Tuesday. The package caused regressions (features that stopped working) on some systems, and the company released an out-of-band update on September 15 to correct them. The recommendation is to install both: the original package closes critical holes and the emergency one resolves the side effects.

Why so many flaws at once?

Three factors explain the record. First, Microsoft now bundles fixes for components it used to handle separately, such as parts of Azure and Office, in the same bulletin. Second, AI vulnerability-hunting tools — including those from the AI labs, which reached “Critical” cybersecurity capability levels this month — are accelerating discovery. Third, Windows 11 26H2, due later this year, concentrates foundational changes that require chains of fixes.

What broke and the emergency update

After Patch Tuesday, users and administrators reported regressions — behaviors that worked before and failed after updating. Microsoft acknowledged the issues and shipped a fix outside the monthly cycle on September 15. Out-of-band updates are rare and signal meaningful impact, usually in enterprise environments.

What to do on your PC (checklist)

Why this matters to you

Fixed flaws are public flaws: as soon as the bulletin ships, attackers reverse-engineer the patches to target anyone who has not updated. With ~1,000 fixes and AI models capable of generating exploits in minutes, the window between “patch released” and “mass exploitation” has never been shorter. Delaying the update out of fear of bugs is a bigger risk than the bugs themselves — and the emergency update exists precisely to reduce that fear.

Frequently asked questions

How many vulnerabilities did the September 2026 Patch Tuesday fix?

Roughly 1,000, the largest number in Microsoft’s history for a single monthly cycle.

Should I install the Windows emergency update?

Yes. It fixes regressions introduced by the September 8 Patch Tuesday. Install it through Windows Update.

What is an “out-of-band” update?

A package released outside the monthly schedule (the second Tuesday) to fix an urgent problem. It is rare and indicates meaningful impact.

At DigitalRadar, we translate security and computing for everyday life. Stay on the radar so you do not miss the next alert.