Microsoft Addresses 974 Flaws in September Patch Tuesday, CISA Adds Exploited Vulnerabilities to KEV Catalog

Microsoft has released its September 2026 Patch Tuesday updates, addressing a significant 974 vulnerabilities across its products. This includes two previously undisclosed flaws that are known to be actively exploited, allowing for privilege escalation. In related news, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities impacting Cisco, Citrix, and Fortinet to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply patches by September 12, 2026, due to evidence of active exploitation.