For IT teams, the second Tuesday of the month is still the day everything else gets rearranged around. Microsoft uses the slot to ship its monthly bundle of security fixes, and Computerworld has been collecting the totals for years so administrators can plan a patch window without hunting for last month's blog post.
Looking back over the first half of 2026, the rhythm is familiar: a wave of CVEs, a small number under active exploitation, and a recommendation on what to prioritise. Some months are quiet, others are not, and the gap between the two keeps getting wider.
What happened
- September 2026 was the biggest of the year so far, with 963 CVEs and two exploited flaws, including one in the Windows Update Stack.
- August 2026 closed 751 CVEs across product families, 108 rated critical, and one exploited elevation-of-privilege flaw in the Windows WinSock driver.
- July 2026 covered 722 CVEs, two under active exploitation and one BitLocker bypass disclosed but not exploited.
- June 2026 was lighter at 206 updates but included three publicly disclosed Windows vulnerabilities rated "Exploitation More Likely."
- May 2026 closed 139 updates with no zero-days, a useful breather before the heavier summer months.
Why the trend matters for administrators
Month-to-month the numbers swing hard. May was almost a holiday, then June through September piled on the volume. The pattern matters because most teams run a single patch window per cycle, and the size of that window has to flex with the size of the release. A 139-fix month is a tidy Tuesday. A 963-fix month is a project.
The exploited flaws are the real schedule-setters. September's pair included a Windows Update Stack issue and an Advanced Local Procedure Call vulnerability; August's exploited bug was in the WinSock driver and immediately flagged for a smoke test after patching. Each of those is the kind of fix that needs to land before anything else.
The bigger story is end-of-support dates arriving inside the patch calendar. Several older server products crossed their retirement line during one of the busiest months of the year, which is the kind of collision an admin wants to see coming rather than discover mid-sprint.
What it means for you
If your team treats Patch Tuesday as a routine checkbox, the 2026 numbers are a reminder that the routine gets loud several times a year. Plan for two or three "heavy" months with full war-room coverage, and a quieter lane for the rest. Keep a rolling register of which servers and workstations are still on versions that are about to age out, and line their migrations up with the heaviest patch cycles so you are not rebooting twice.
For agile teams, the patch window is a forcing function. If your sprint review is on Wednesday, treat Tuesday's release as a sprint input, not a distraction. Roll the exploited fixes into the current sprint and let the lower-priority items sit in the backlog with a fix-version tag.
Worked example: a mid-size IT team
Say you run operations for a 600-seat firm with a mixed Windows estate and an on-prem SQL Server. In July, you are staring at 722 CVEs landing while older SharePoint and SQL Server editions drop off support on the same day. Your move: freeze non-critical changes for the week, patch the exploited Active Directory Federation Services and SharePoint flaws first, schedule the legacy upgrade to start the moment patching is done, and keep the older database engine on a separate, slower track with a hard deadline you have already socialised with the database owners. Doing it in that order stops the patch window from snowballing into a migration project.
What to watch next
Two things. First, the trend in exploited flaws per release, which has stayed at one or two each month but has not gone to zero. Second, the end-of-support calendar through 2027, because more SQL Server and older Windows milestones will land on top of patch months. If you are still on a 2016-era stack, treat that as a sprint of its own, not a side task.
Key takeaways
- Patch Tuesday has stayed the anchor point for IT security in 2026, with monthly CVE counts ranging from 139 to 963.
- Exploited flaws stayed in the one-to-two-per-month band, but each one demanded priority treatment inside the usual patch window.
- End-of-support dates for legacy server products landed inside heavy patch months, raising the stakes for planning.
Frequently asked questions
Which Patch Tuesday was the biggest in 2026 so far?
September 2026, with 963 CVEs and two exploited flaws, according to Computerworld's running list.
Were there any actively exploited zero-days in this period?
Yes. September had two, August had one, July had two, and June had three publicly disclosed flaws rated "Exploitation More Likely," per the same roundup.
What should IT teams prioritise first when a heavy Patch Tuesday lands?
The exploited Windows, Office and SQL Server fixes, plus anything tied to end-of-support products that ship in the same cycle.
Is May 2026 really that much lighter than the rest?
Yes. May closed 139 updates with no zero-days, which makes it a useful baseline month for routine patching and catch-up.