September 2026 Patch Tuesday: 20 Critical Office Bugs to Fix Now
Microsoft’s September 2026 Patch Tuesday landed on September 8, 2026 with a record 966 fixes, and Office took the worst of it: 124 patches across Word, Excel, Outlook and the shared code, 20 of them rated Critical. Excel alone has six Critical remote code execution holes, which means a single booby trapped workbook can run an attacker’s code on your PC. The two flaws already being exploited are in Windows rather than Office, so run Windows Update as well as the Office update. Here is what to patch, in what order, and what not to open until you have.
By our count of Microsoft’s own list, 124 of those patches are for Office apps, and 20 of them are rated Critical. Add the Office Graphics Component flaw and it’s 21. That means Office accounts for about one in five of the Critical fixes this month.
Neither of the two exploited zero days is in Office. Both are Windows problems: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call (ALPC), each letting an attacker who is already on the machine grab SYSTEM privileges. That’s small comfort. The Office list this month is enormous.
Office patches by app
| App | Patches | Rated Critical |
| Word | 38 | 3 |
| Excel | 32 | 6 |
| SharePoint | 16 | 0 |
| Office (shared code) | 15 | 4 |
| PowerPoint | 10 | 3 |
| Outlook | 7 | 4 |
| Access | 4 | 0 |
| Publisher | 2 | 0 |
| Total | 124 | 20 |
Separately, CVE-2026-78439, a Microsoft Office Graphics Component remote code execution flaw, is also rated Critical. It sits under the Graphics Component tag rather than Office, but it’s an Office bug in everything but name.
Skype for Business picked up 10 fixes and Exchange Server 9 fixes, if you run either.
Publisher 365 gets its last updates
Publisher 365 received its last two patches before it stops working on October 1, 2026, just a few weeks away.
The Critical updates, by name
Excel is the worst offender with six Critical remote code execution flaws: CVE-2026-81948, CVE-2026-81949, CVE-2026-81950, CVE-2026-81951, CVE-2026-81953 and CVE-2026-81959. Remote code execution means a booby trapped workbook can run an attacker’s code on your PC.
Outlook has the highest proportion of Critical fixes: four out of seven. CVE-2026-78509, CVE-2026-78519 and CVE-2026-78525 are remote code execution. CVE-2026-78520 is an information disclosure flaw, also rated Critical. A Critical rated information leak is unusual and normally means something sensitive escapes without much user interaction. If you manage a mailbox server or a fleet of desktops, read that advisory properly.
Word: CVE-2026-77504, CVE-2026-78510 and CVE-2026-81952, all remote code execution.
PowerPoint: CVE-2026-69678, CVE-2026-69767 and CVE-2026-69797, all remote code execution.
Office shared code, which affects all the apps at once: CVE-2026-69285, CVE-2026-69632, CVE-2026-77898 and CVE-2026-78505.
What this means for you
Twenty Critical Office flaws in one month is not a normal Patch Tuesday. Even so, it is worth a moment’s caution before rushing to update, because Microsoft’s patch reliability record is patchy.
Microsoft 365, Office 2024/2021: open any Office app, then File | Account | Update Options | Update Now. Close and reopen the apps afterwards.
Also run Windows Update to close vulnerabilities in the operating system.
Until you have patched, the standard discipline matters more than it does in a normal month. Don’t open Office attachments from people you don’t know, and treat Excel files from outside your organization with suspicion. Six Critical Excel flaws is a lot of ways for a single spreadsheet to ruin your day.
Why the patch numbers keep climbing
This is not a sudden collapse in Microsoft’s code quality. The company has been using an AI powered vulnerability discovery system to find flaws across its products, and the totals show it: 570 flaws in July, over 400 in August, and now 966.
It’s good that AI is finding more vulnerabilities before they are exploited. Keep in mind that hackers and criminals have AI tools too, and they use them to find new exploits. It’s the same battle between hackers and software makers, just raised to a new, largely automated level.
The practical effect for Office users is that monthly updates are getting bigger, slower to install and harder to ignore. Expect more of the same.
More on Office security and updates
This is the third heavy month in a row, and the pattern is worth understanding. August 2026 Patch Tuesday: Office Bugs That Fire From the Preview Pane covered ten Critical bugs that needed no click at all, and July 2026 Patch Tuesday: 570 Fixes and a Critical BitLocker Flaw included a bypass that made stolen laptops trivial to open. Microsoft occasionally breaks its own schedule too, as it did with the Emergency Office Update: What Every Customer Needs to Know Now.
Six Critical Excel holes only matter if a bad file reaches you, and the tricks are always the same. How hackers trick you to open infected documents shows the exact wording criminals use to get you past the warnings, and New Outlook attachment Viewing warning hides the way out explains Protected View, the read only mode that stands between you and a booby trapped workbook.
The preview pane is still a soft spot, and knowing where the setting lives is worth five minutes. All the email preview options in Outlook covers the Reading Pane, Message Preview and attachment previews, including how to turn it off across every folder rather than just the one you are looking at.
How fast this month’s fix actually reaches you depends on a setting most people never touch. All the options for Microsoft Office 365 update channels explains what Current, Monthly Enterprise and Semi Annual really mean for patch timing, and Simple ‘one click’ force an update to Microsoft Office shows the command line trick that skips the menu digging, plus how to roll back if an update goes wrong.
Running an older Office and wondering whether any of these 124 patches reach you? Office 2019 Is Still Getting Security Updates, But Only for Some sets out who is still covered and who has quietly been dropped. With Publisher switching off in three weeks, Microsoft Publisher Ends October 2026: How to Keep It Working has the workarounds, and our Microsoft Office support end dates checklist lists every remaining deadline in one place.