September 2026 Patch Tuesday shows why exploit status beats CVSS

At a glance

What this is: This Patch Tuesday analysis argues that the exploited Windows EoP flaw should outrank higher-scored CVEs because it is already in active use and turns a foothold into SYSTEM-level control.

Why it matters: For endpoint, patch, and identity teams, the key lesson is that remediation order should follow attack-chain position and exploit status, not just CVSS or Critical labels.

By the numbers:

• Microsoft shipped 971 fixes in September, including 112 Critical vulnerabilities and 1 Low vulnerability, according to Absolute Security.
• Microsoft's SharePoint release included 16 CVEs spanning remote code execution, elevation of privilege, spoofing and information disclosure, according to Absolute Security.

Context

Patch prioritisation fails when teams treat severity scores as a proxy for real-world risk. CVSS is useful for comparing theoretical impact, but it does not show whether a flaw is being exploited, where it sits in an attack chain, or whether it converts an initial foothold into full control.

This month’s release is a good example of why endpoint and identity-adjacent operations need exploitation-aware triage. The article is mostly about Windows and Microsoft platform vulnerabilities, but it also touches identity protection boundaries such as Credential Guard and the escalation paths that can undermine them.

The exploited flaw is therefore less about a single bug than about the control gap between detection and remediation. That makes the article relevant to patch governance, vulnerability management, and any programme that assumes high scores will always be the right first fix.

Key questions

Q: What breaks when an exploited vulnerability has no CVSS score but does have active exploitation?

A: Severity labels stop being a reliable queueing tool when a flaw is already being used in the wild. The control failure is assuming the score reflects attacker behaviour. Practitioners should prioritise exploit status, attack-chain position, and reachable blast radius before they sort by numeric severity.

Q: Why do preview-pane vulnerabilities change endpoint risk so quickly?

A: Because they remove a major friction point between delivery and execution. When a file can trigger code execution during preview, the attacker does not need a macro, a click, or a user to enable content. That shifts the defence problem to attachment handling, content filtering, and execution surface reduction.

Q: How do security teams decide whether to patch a high-score vulnerability first?

A: Teams should compare exploitability, current attack activity, and the vulnerability's place in the chain rather than relying on score alone. A lower-scored flaw that gives SYSTEM privileges or enables initial code execution is usually more urgent than a higher-scored flaw that is not exploitable in practice.

Q: Should organisations treat vendor-remediated service vulnerabilities the same as local patch work?

A: No. If the vendor has already fixed the issue on the service side, the response changes from patch execution to risk verification and reporting. Local remediation effort should stay focused on defects that still require customer action and still change exposure.

Technical breakdown

Why an exploited elevation-of-privilege flaw outranks higher scores

An elevation-of-privilege flaw becomes strategically important when it sits after initial access and before full administrative control. In this case, the vulnerability is a Windows Update Stack link-following issue that allows a successful attacker to move from a foothold to SYSTEM privileges. That changes the practical meaning of the bug from abstract severity to attack-chain acceleration. CVSS does not encode whether an attacker already has a foothold, whether exploitation is active, or whether the bug materially changes blast radius. Practical implication: prioritize flaws that complete the path from foothold to control, even when they are not rated Critical.

Practical implication: triage exploited EoP issues ahead of higher-scored flaws that do not materially change attacker control.

Why preview-pane remote code execution creates low-friction initial access

Remote code execution through a preview pane is dangerous because it removes the user interaction that defenders often rely on as a friction point. If a malicious document can trigger code execution during preview, then email filtering, attachment handling, and office hardening become the main controls between delivery and compromise. The article highlights multiple Microsoft Office and Outlook CVEs where simply previewing a file can be enough. That makes the preview surface an execution boundary, not just a convenience feature. Practical implication: treat preview functionality as a live attack surface and apply control validation to it, not just to macro execution.

Practical implication: validate whether preview-pane exposure is actually necessary and protect it as an execution path.

How service-side fixes change patching decisions

Not every high-score vulnerability should enter the same local patch queue. Some CVEs are fully mitigated by the vendor on the service side, which means customer-side patching is not the immediate control point even if the score is 10.0 or 9.9. That distinction matters because vulnerability management programs often mix theoretical criticality with operational urgency. When the vendor has already remediated the service, the control objective shifts from patching to risk communication and verification. Practical implication: separate customer-actionable defects from provider-remediated ones before scheduling remediation work.

Practical implication: split vendor-remediated service flaws from locally actionable patches before allocating remediation effort.

Threat narrative

Attacker objective: The attacker wants to turn a modest foothold into high-trust system control and then extend that control across the affected environment.

1. Entry occurs through a low-friction code execution path such as the Outlook or Office Preview Pane, or through an exposed edge service like RRAS.
2. Credential or privilege access follows when the attacker uses an exploited elevation-of-privilege flaw to move from foothold to SYSTEM or similarly elevated control.
3. Impact is achieved when that control is used to expand reach across endpoints, edge services, or protected identity boundaries such as Credential Guard-enabled environments.

Breaches seen in the wild

• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.
• LiteLLM MCP auth bypass 2026: An exploited LiteLLM MCP auth bypass and default sk-1234 master keys let attackers steal AI gateway master and provider API keys.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Exploit status has become the more operationally useful risk signal than CVSS. Scores still matter for comparison, but they are secondary when an attacker is already using a flaw in the wild. For practitioners, the governance problem is not lack of scoring, it is over-trusting scoring as a queueing mechanism.

Patch Tuesday is now an attack-chain management exercise, not a severity-ranking exercise. The release mixes entry points, privilege escalation bugs, and service-side mitigations, which means teams need to reason about where a vulnerability sits in the chain. That is especially important for endpoint estates tied to identity protection, because local compromise can still undermine trust boundaries such as Credential Guard.

Preview surfaces are a control boundary, not a convenience setting. When four separate Microsoft Office and Outlook paths can start with a preview, the issue is not user error but architectural exposure. The practical conclusion is that email and office hardening must be measured by how much execution is still reachable before a click, not by how many filters are enabled.

Patch governance needs a named concept: exploit-position prioritisation. This article shows that the right ordering criterion is where a flaw sits in the attacker sequence, not how alarming it looks on paper. NHI Mgmt Group's view is that vulnerability programmes should explicitly rank by exploit position, because that is what determines whether a defect becomes an entry point or an escalation step.

What this signals

Exploit-position prioritisation: this article supports a more precise patch-governance model in which teams rank vulnerabilities by where they sit in the attacker sequence. That is a better operational lens than severity alone because it captures whether a flaw enables entry, escalation, or full control.

For readers running endpoint and identity-adjacent programmes, the lesson is to separate direct remediation from service-side mitigation and to treat preview-based execution paths as real attack surfaces. That shift improves triage quality without adding noise to the patch queue.

For practitioners

• Patch exploited EoP flaws first Move actively exploited elevation-of-privilege issues to the front of the queue even when they are not the highest-scored items. Treat a flaw that converts foothold to SYSTEM as more urgent than a theoretical Critical CVE that has no exploitation evidence.
• Treat preview panes as execution surfaces Review whether Outlook and Office preview functionality is required for all user groups, then harden or constrain it where possible. Pair attachment filtering with policy controls that assume preview can itself trigger code execution.
• Separate service-side mitigations from local patches Create a triage step that filters out CVEs already fully mitigated by the vendor on the service side before you assign endpoint work. That prevents high scores from crowding out flaws that still require direct customer remediation.
• Inventory edge services that can chain into internal trust Check whether RRAS, Hyper-V, or similar infrastructure components are only edge-exposed or whether they sit near domain-facing roles. A low-level foothold on a box that also touches identity infrastructure changes the urgency of the patch decision.

Key takeaways

• The article shows that a lower-rated flaw can matter more than a Critical one when it is already being exploited and can turn a foothold into SYSTEM control.
• Multiple Microsoft Office and Outlook vulnerabilities this month demonstrate that preview functionality can be enough for code execution, which makes email hardening a control-boundary issue.
• Patch programmes should rank by exploit status, attack-chain position, and whether a flaw changes control of the host, not by CVSS alone.

Key terms

• Exploit Position: The place a vulnerability occupies within an attacker sequence, such as entry, privilege escalation, or post-compromise expansion. This matters because the same score can have very different operational meaning depending on whether the bug opens access, deepens control, or only increases theoretical impact.
• Attack Surface Reduction: Attack surface reduction is the practice of removing or constraining the externally reachable paths an attacker can use to find, authenticate to, or exploit a system. In operational terms, it means shrinking public exposure, closing unused interfaces, and limiting what reachable services can do if compromised.
• Elevalation of Privilege: A vulnerability class that lets an attacker move from a lower permission level to a higher one, often from a foothold to administrative control. The key risk is not initial access but the ability to turn limited compromise into system-level authority.
• Preview-Triggered Execution: A condition where simply rendering or previewing content can trigger code execution without a deliberate open action. This pattern collapses the normal user-intent boundary and shifts security attention to content handling, attachment filtering, and application hardening.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners connect lifecycle control to broader access risk.