September 2026 Third-Party Vulnerabilities and Patches 

September brought a lot of vulnerabilities. During the month we identified 1,374 unique vulnerabilities across 77 applications, and vendors released 166 patched versions to fix them. That is a big swing from August, which landed at 853, so month over month the count rose by roughly 61%. It puts September second only to July in everything we have ever recorded, ahead of June, and far above the 80 to 140 range that was completely normal through 2024 and 2025.  

So, the brief dip in August really was just a breather, not a change in direction. The shape of this month is worth a closer look though. The vulnerability count climbed high while the number of affected applications actually came down, from 85 in August to 77 in September. In other words, a lot more vulnerabilities landed on slightly fewer products, which is a strong sign that the activity was packed into a small number of very busy vendors. 

Just like in recent months, most of this comes from the large, coordinated security releases that Chromium-based browsers ship. Chromium products on their own accounted for about 811 of the 1,374 vulnerabilities, and once you add Firefox, Waterfox, and Pale Moon, the browser category makes up close to three quarters of everything we saw. What stood out this month is that Brave led the pack with 761 vulnerabilities across seven releases, ahead of Microsoft Edge at 652 and Google Chrome at 466. This was because Brave shipped several Chromium version bumps during the month, and each one pulled in another batch of upstream fixes.  

The single biggest update was Microsoft Edge 153.0.4234.32, which closed 466 vulnerabilities on its own. Because Chromium fixes flow down into every browser built on top of it, one upstream release spreads the same hundreds of fixes across several products and channels, so these numbers say more about how Chromium coordinates its patching than about hundreds of separate findings. That same effect is why fewer applications can carry so many more vulnerabilities, and why one busy month for Chromium moves our totals so sharply. 

Notable vulnerabilities in September third-party patches 

The vulnerabilities below stand out either because a working exploit already exists or because they carry an elevated EPSS score above 0.1. Both raise the odds of real-world abuse and shorten the time you have to patch safely, so they are the ones worth prioritizing. This month four cleared the bar, and all already have known exploits and sit in CISA’s Known Exploited Vulnerabilities catalog, so none of these are theoretical. 

CVE-2026-85046 is the standout this month, and it’s a textbook example of the patch gap in action. It’s a high-severity type confusion vulnerability in V8, the JavaScript engine inside Google Chrome and Chromium-based Microsoft Edge. It lets a remote attacker run code inside the browser sandbox through a crafted web page. It carries a CVSS score of 8.8, is confirmed exploited in the wild, sits in CISA’s Known Exploited Vulnerabilities catalog, and holds the highest EPSS score we saw all month at about 0.49. What makes it notable isn’t the bug on its own, but how it was used. According to Microsoft Threat Intelligence, several China-based threat actors, including Violet Typhoon, chained this flaw with a second Chromium bug (CVE-2026-87491) and a Windows local privilege escalation zero day (CVE-2026-85880) to move from a single malicious web page all the way to full SYSTEM control.  

The victims were reached through spear phishing links that quietly redirected them to the final browser exploit. The timing is the real lesson. Google shipped the underlying V8 fixes on August 7 and 11, but the Chromium browsers built on top, including Edge and Chrome, didn’t deliver them to users until early September because of their own release cycles. Attackers started using the chain on August 20, right inside that gap when the fix existed but had not reached most machines yet. This is exactly the pattern we keep warning about: The patch was available, but the time it took to actually land on endpoints is what opened the door. It affects Chrome before 152.0.7977.82, and Edge users got the fix in the September release. Anyone running a Chromium-based browser should make sure it’s fully up to date. More information is available in CISA’s KEV entry, the Google Chrome release notes, and the Volexity report. 

CVE-2026-87491 is the second browser zero day this month and the other Chromium half of the exploit chain described above. It’s a high severity out of bounds write in V8, again affecting Google Chrome and Chromium-based browsers. Like the first one, it allows code execution inside the sandbox through a crafted web page. It carries a CVSS score of 8.8, a working exploit exists in the wild, and it’s listed in CISA’s KEV catalog. It affects Chrome before 153.0.8010.36. Its EPSS score is still low at about 0.03, but the confirmed real-world exploitation is the reason it earns a mention. It’s fixed in a later update than CVE-2026-85046, so Chrome needs to be on version 153.0.8010.36 or newer to close both. More information is available in CISA’s KEV entry and the Google Chrome release notes. 

CVE-2026-82078 is the most severe of the group by score. Like the browser bugs above, it was put to work in the wild almost right away. It’s a critical vulnerability in PaperCut MF and NG print management software, rated CVSS 9.4, where unsafe handling in the server code lets an attacker run arbitrary code in the security context of the PaperCut server. A known exploit exists and is listed in CISA’s KEV catalog. What stands out is how it was used. GreyNoise tracked a campaign, later picked up by Microsoft Threat Intelligence, in which a likely Russian speaking actor used AI agents and public offensive tools to build, test, and automate exploitation of this flaw together with CVE-2026-81578.  

Starting around the end of August the actor compromised at least 440 PaperCut instances across 395 organizations in 48 countries, then moved deeper with credential theft, LSASS memory access, and registry secret collection. They were able to reach full domain administrator control in twelve of those organizations. PaperCut has been a favorite target before, and past intrusions have ended in extortion, so this one deserves quick attention. PaperCut disclosed both bugs on August 27 and warned they were already being exploited, telling customers to treat exposed servers as potentially breached. The fix ships in PaperCut MF and NG versions 24.1.10, 25.0.13, and 26.0.5. More information is available in the PaperCut security advisory, CISA’s KEV entry, and the GreyNoise report. 

CVE-2026-81578 is the second PaperCut MF and NG flaw this month and the partner of the critical bug above. It’s a high-severity authentication bypass rated CVSS 8.8. In the same AI driven campaign, the attacker used it to slip past login before chaining the code execution flaw to take over the server. A known exploit exists and is listed in CISA’s KEV catalog. The fix ships in PaperCut MF and NG versions 24.1.10, 25.0.13, and 26.0.5. More information is available in the PaperCut security advisory and CISA’s KEV entry. 

Taken together, these four show both sides of what we’ve been talking about all year. The Chrome chain shows the patch gap at work, where the fix existed upstream but had not yet reached endpoints when attackers moved in. The PaperCut campaign shows attackers using AI agents to turn fresh vulnerabilities into mass exploitation within days. In both cases what mattered most was how quickly the fix actually reached the machine. 

Browser security updates in September 2026 

Browser updates were once again the biggest driver of vulnerability activity in September, following the same pattern we’ve seen all year. The table below breaks the counts down by browser. This month Brave led the way with 761 vulnerabilities addressed across seven releases, with Microsoft Edge close behind at 652 across seven, and Google Chrome at 466. Because all these browsers are built on Chromium, most of these fixes trace back to the same upstream security releases, so the counts are better read as one coordinated patching effort than as separate findings. Mozilla-based browsers were much quieter by comparison. Mozilla Firefox fixed 173 vulnerabilities, and its 115, 140, and 153 branches handled another 72, 54, and 43. Waterfox, which is also built on Firefox, remediated another 88, and Pale Moon added 12. Interestingly, Vivaldi and Opera didn’t ship updates that reached our catalog this month, which is a small reminder that not every Chromium browser moves on the same schedule. Put together, these browser numbers make up the large majority of everything fixed this month, which is why a single busy month for Chromium can move our totals so sharply. 

Microsoft product updates included in September 2026 third-party patches 

Microsoft issued security updates for several other products: 

• Microsoft .NET Runtime 10.0 
• Microsoft .NET Runtime 8.0 
• Microsoft .NET Runtime 9.0 
• Microsoft .NET SDK 10.0 
• Microsoft .NET SDK 8.0 
• Microsoft .NET SDK 9.0 
• Microsoft 365 Access Runtime 
• Microsoft 365 Apps 
• Microsoft ASP.NET Core Runtime 10.0 
• Microsoft ASP.NET Core Runtime 8.0 
• Microsoft ASP.NET Core Runtime 9.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 10.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 8.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 9.0 
• Microsoft Edge for Business 
• Microsoft Project 
• Microsoft Visio 
• Microsoft Visual Studio 2019 Enterprise 
• Microsoft Visual Studio 2019 Professional 
• Microsoft Visual Studio 2022 Enterprise 
• Microsoft Visual Studio 2022 Professional 
• Microsoft Visual Studio Code 
• Microsoft Windows Desktop Runtime 10.0 
• Microsoft Windows Desktop Runtime 8.0 
• Microsoft Windows Desktop Runtime 9.0 

Detailed list of September third-party patches