Known Exploited Vulnerabilities Catalog

www.cisa.gov • September 10, 2026

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( ) or https:// means you’ve safely connected to the .gov website. sensitive information only on official, secure websites.

Are you aware of an actively exploited vulnerability not included in the KEV Catalog? NOMINATE A NEW KEV

The KEV catalog is also available in these formats: CSV JSON Print View JSON Schema (updated 06-25-2024) License

Related CWEs: CWE-59 | CWE-284

Known To Be Used in Ransomware Campaigns? Unknown

Forensic triage required per BOD-26-04: No

Date Added: 2026-09-08

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft September 2026 Patch Tuesday: Record 974 Vulnerabilities Addressed On September 8, 2026, Microsoft released a record-breaking 974 patches for vulnerabilities across its products, including two actively exploited zero-day vulnerabilities: CVE-2026-81963 and CVE-2026-85880. These vulnerabilities allow local attackers to escalate privileges to SYSTEM level, posing significant risks to affected systems. The update includes 723 vulnerabilities in Windows, 111 in Office, and others across various Microsoft services. The scale of this release reflects a growing trend of increased vulnerability disclosures, attributed in part to AI-assisted discovery methods. Organizations are urged to prioritize patching these critical vulnerabilities to mitigate potential exploitation. The overall patch count surpasses previous months, indicating a new norm in vulnerability management. The urgency for remediation is heightened due to the confirmed exploitation of the zero-day vulnerabilities in the wild. 82 sources 73

Known Exploited Vulnerabilities Catalog

The full story

Extracted Entities

Countries (1)

CWE Weaknesses (1)