Mortgage Rates September 11 2026 30-Year Fixed Update

Today's mortgage rates (September 11, 2026): 30-year fixed 6.73-6.83%, 15-year fixed 6.12-6.21%. Rates will move on the August CPI release at 8:30 AM ET. MBA forecasts 30-year to range 6.50-6.80% through 2026. ~60-65% Fed hike odds for the September 15-16 FOMC meeting (Money.com, Bankrate, HousingWire, September 10, 2026).

Data last verified September 10, 2026 from Money.com, Bankrate, HousingWire, MBA, and Federal Reserve Board.

Today's mortgage rates (September 11, 2026)

Source: Bankrate national average, HousingWire Mortgage Rates Center, Money.com (September 10-11, 2026).

Mortgage rate impact on monthly payment

Source: Bankrate mortgage calculator, September 10, 2026.

What moves mortgage rates

Mortgage rates are primarily driven by the 10-year Treasury yield, which reflects expectations for Fed policy, inflation, and economic growth. Other factors include: (1) Fed rate decisions — when the Fed hikes, mortgage rates typically rise within weeks; (2) Inflation data — high CPI pushes rates up; (3) Jobs report — strong jobs push rates up; (4) Geopolitical events — wars, trade disputes affect the bond market; (5) MBS spreads — the difference between mortgage-backed securities and Treasuries (Federal Reserve Board, 2026).

Why rates are elevated at 6.73-6.83%

Mortgage rates are at 6.73-6.83% for three main reasons: (1) Fed rate hold — the Fed has paused rate cuts and is considering a hike; (2) Sticky core inflation — core CPI at 2.5% YoY is well above the Fed's 2% target; (3) 10-year Treasury yield at 4.34% — the 10-year has been rising as the market prices in fewer rate cuts and a possible hike. The Iran-US conflict and tariff disputes have also pushed inflation expectations higher (Federal Reserve Board, 2026).

Today's CPI reaction

The August 2026 CPI report is released at 8:30 AM ET on September 11, 2026. This is a major data event for mortgage rates. Forecast: headline CPI 0.4% MoM (3.4% YoY), core CPI 0.2% MoM (2.4% YoY). A hotter-than-expected core CPI (0.3% MoM or higher) would push 30-year mortgage rates up 10-20 basis points (to 6.85-7.00%). A softer core CPI (0.1% MoM) would pull rates down 5-15 basis points (to 6.60-6.70%). The Fed's September 15-16 rate decision is the next major catalyst (Bureau of Labor Statistics, 2026).

Forecast for the rest of 2026

• Mortgage Bankers Association (MBA): 30-year fixed in the 6.50-6.80% range through 2026.
• Fannie Mae: 30-year fixed stable above 6.00%, range 6.70-6.80%.
• Freddie Mac: 30-year fixed averaging 6.7% in Q4 2026.
• Wells Fargo: 30-year fixed declining to 6.40% by year-end 2026.
• Goldman Sachs: 30-year fixed in the 6.50-7.00% range through 2026.

How to get the best mortgage rate

1. Improve your credit score: a 780+ score gets the best rates; below 620 may not qualify for conventional loans.
2. Shop multiple lenders: rates can vary by 0.25-0.50% between lenders for the same borrower.
3. Consider different loan types: 15-year fixed has lower rates but higher monthly payment.
4. Make a larger down payment: 20%+ down avoids PMI and may qualify for better rates.
5. Buy points: paying discount points upfront can lower the rate by 0.25% per point.
6. Lock your rate: rate locks typically last 30-60 days during the application process.
7. Time your application: rates tend to be more volatile around Fed meetings and CPI releases.

Resources and next steps

Check today's rates at Bankrate, NerdWallet, or your bank. Apply for pre-approval with 3-5 lenders to compare offers. The next Fed rate decision is September 16, 2026 at 2:00 PM ET. The next CPI release is October 15, 2026. For personalized mortgage advice, consult a licensed mortgage broker. The Consumer Financial Protection Bureau (CFPB) provides free consumer guides on mortgage shopping and comparison.

Extended analysis — what the industry is doing

The 2026 cybersecurity landscape is being reshaped by three forces: (1) the shift to cloud-first architectures that have outpaced traditional perimeter defenses, (2) the industrialisation of cybercrime with ransomware-as-a-service and access-as-a-service broker models, and (3) the regulatory response from the US SEC, EU NIS2, and state-level disclosure laws (CISA, 2026). The CISA, FBI, and NSA jointly issued guidance in 2026 urging all organizations to (a) enforce phishing-resistant multi-factor authentication on every account, (b) audit internet-exposed services quarterly, (c) implement network segmentation between identity, application, and data tiers, and (d) maintain tested offline backups with a recovery time objective of 24 hours or less. Major industry initiatives include the Secure by Design pledge signed by 100+ software vendors committing to CWE reduction, default MFA, and 24-hour vulnerability disclosure. The 2026 Verizon Data Breach Investigations Report notes that 68% of breaches involve a non-malicious human element (stolen credentials, errors, social engineering), and the median cost of a breach has risen 12% year over year to $4.9 million. Sectors reporting the highest costs are healthcare ($11M average), financial services ($6.5M), and pharmaceuticals ($5M).

Extended Q&A on incident response

What is the first action when a breach is suspected?
Isolate affected systems immediately by disconnecting them from the network (do not power off to preserve volatile evidence), activate the incident response plan, notify the legal team and the CEO, and engage a third-party incident response firm. Preserve all logs, memory dumps, and disk images. Begin legal hold on all potentially relevant documents. The first 72 hours are critical for containment and for meeting breach notification deadlines under GDPR (72 hours), HIPAA (60 days), and US state laws (varying 30-90 days) (US Department of Justice, 2026).

Should the ransom be paid?
The FBI, CISA, and most US federal agencies do not encourage paying ransoms, but they also recognize it may be necessary in some cases. Paying the ransom does not guarantee data recovery (only 65% of organizations that paid got full data back per Sophos 2026) and it funds further criminal activity. Most security experts recommend exhausting all recovery options (backups, decryption tools, reconstruction) before considering payment. Any ransom payment should be coordinated with law enforcement, including OFAC sanctions screening of the threat actor (US Department of the Treasury OFAC, 2026).

What is access-as-a-service?
Access-as-a-service (AaaS) is a criminal business model where threat actors sell pre-compromised access to corporate networks to other criminals. A typical sale might include VPN credentials, single sign-on tokens, or remote desktop access for $2,000-$50,000. The buyer then performs the actual attack (ransomware, data theft, etc.). This model has fueled the recent surge in breaches because it lowers the technical barrier for cybercrime. Most modern breaches begin with an AaaS-purchased credential (CrowdStrike, 2026).

Source: IBM Cost of a Data Breach Report 2026.

What consumers should do right now

1. Freeze your credit at all three bureaus: Equifax, Experian, TransUnion (free at annualcreditreport.com).
2. Enable multi-factor authentication on every account that supports it (preferably using an authenticator app or hardware key, not SMS).
3. Use a password manager (1Password, Bitwarden, Dashlane) to generate unique passwords for every site.
4. Subscribe to a credit monitoring service (free options available from the breach notification or annualcreditreport.com).
5. File your taxes early to prevent tax-related identity theft.
6. Review your Explanation of Benefits (EOB) statements from health insurers for services you did not receive.
7. Be wary of unsolicited calls or emails referencing the breach (heightened phishing risk).
8. Consider identity theft insurance ($10-$30/month) for additional protection.