September 2026 Patch Tuesday
What's happened since August Patch Tuesday It's been an active month between cycles. Since Microsoft's August 11 release, five Microsoft CVEs have been confirmed exploited in the wild, and Google shipped an emergency Chrome fix for a sixth 2026 zero-day. None of this is theoretical — all six are on CISA's Known Exploited Vulnerabilities catalog today, and two carry active nation-state attribution. Before we get into today's release, here's what defenders should already have handled — or should escalate immediately if not: Microsoft — confirmed exploited since (and including) the August release: CVE-2026-68820 — Windows Ancillary Function Driver for WinSock (afd.sys), Elevation of Privilege.
Read at Ivanti security advisories (blog)
- Vendor
- Ivanti, Microsoft, Google
- Product
- Chrome
- CVSS
- 7.0
- EPSS
- 0.039 (p90)
- Exploitation
- observed in the wild
- Fix
- available
- Exposure class
- Browser
Why it ranks 71 (Critical)
- Exploitation observed in the wild
- CVSS 7.0 high
- Product class: browser
- Widely deployed vendor product (Ivanti)
- Covered by 5 independent sources
- Fix available
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Ivanti security advisories (blog) (ivanti.com)
- CVE-2026-68820 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-33824 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-55040 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-63520 on this site · NVD · CVE.org · Vulnpedia
- CVE-2019-1068 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.