September patch surge exposes why exploited zero-days come first

At a glance

What this is: This is a patch-prioritisation analysis showing that September’s record Microsoft release and Adobe Commerce exploitation should push teams to focus on exploited zero-days and unauthenticated RCE first.

Why it matters: It matters because IAM, PAM, and NHI teams need to treat privileged-path exposure and active exploitation as the deciding factors, not total CVE volume.

By the numbers:

• Microsoft's September release contained 964 CVEs, making it the largest in the company's history.
• Microsoft rated 104 issues critical in the September release.
• Microsoft rated 860 issues important in the September release.
• Elevation of privilege made up 44.7% of the month's CVEs.

Context

Patch backlogs become operationally misleading when teams treat volume as the main sorting signal. The real problem is that a small set of vulnerabilities can create immediate privilege escalation or unauthenticated code execution paths, while the rest wait in the queue. In identity-heavy environments, those paths matter because they often terminate in SYSTEM access, credential theft, or control over sensitive business flows.

This article is about how September’s patch set and Adobe Commerce exploitation change prioritisation logic for security teams. The identity angle is direct: the high-value outcomes are not just code execution, but access to privileged update components, admin tokens, and downstream secrets that sit behind those systems.

Key questions

Q: How should security teams respond when a zero-day is likely to have been exploited already?

A: Treat the issue as an active containment event, not just a patching task. Prioritise isolation of exposed systems, review privileged access paths, and check for persistence in both human and non-human accounts. The aim is to reduce the attacker’s reach before remediation is complete, because patch availability does not mean the environment is still clean.

Q: Why do privilege escalation flaws deserve higher priority than the total CVE count suggests?

A: Because the business risk comes from the result of escalation, not from the number of advisories. A flaw that reaches SYSTEM or breaks out of a sandbox can expose trust boundaries, credentials, and control-plane functions, which changes the blast radius far more than a basic code-execution bug.

Q: How can security teams tell whether a patch issue has become a compromise issue?

A: Look for evidence that the affected system was reachable before remediation, whether exploitation was confirmed in the wild, and whether the flaw could expose privileged paths or secrets. If any of those conditions are true, investigate it as potential compromise rather than a simple pending patch.

Q: What is the difference between a high-severity vulnerability and an exploitable attack path?

A: A high-severity vulnerability may be serious on paper, but an exploitable attack path is one attackers are already using or can use immediately. The latter deserves faster action because it combines severity, reachability, and active abuse, which is what turns patching into an urgent governance decision.

Technical breakdown

Why exploited zero-days jump the queue

An exploited zero-day is already part of an attacker workflow before defenders can react, so patch priority shifts from theoretical exposure to proven abuse. Once a vulnerability is added to a KEV catalog, the question is no longer whether it could be used, but whether it is already being targeted in the wild. That is especially important when the exploit path ends in privilege escalation, because the attacker can move from low-impact access to administrative control with very little additional friction. For identity and access teams, the practical issue is whether the affected system sits on a trust boundary that protects credentials, tokens, or privileged sessions.

Practical implication: Prioritise KEV-listed vulnerabilities that enable privilege escalation or unauthenticated access before the rest of the patch queue.

How local privilege escalation turns a small foothold into SYSTEM access

Local privilege escalation vulnerabilities do not usually grant initial access, but they radically change the value of any foothold an attacker already has. In this release, one flaw abused a privileged update path, while another broke out of a sandboxed AppContainer into SYSTEM. That progression matters because modern environments often assume low-privilege execution is contained, when in practice a sandbox escape can collapse the separation between a benign process and a highly trusted one. The result is not just more access, but access to the controls that manage software, credentials, and security tooling itself.

Practical implication: Treat sandbox escapes and update-component escalation flaws as control-plane risks, not routine endpoint defects.

Why unauthenticated RCE in ecommerce is an identity problem as well as a code problem

Unauthenticated remote code execution in an ecommerce platform is dangerous because it bypasses the normal identity checks that should protect administrative functions and secret-bearing services. In the Adobe Commerce case, attackers could inject code through template handling and then persist on compromised stores, which means the issue is not limited to one exploit moment. Once the platform is under attacker control, the next targets are usually the secrets that power admin access, payment flows, APIs, and deployment paths. That makes the compromise both a runtime problem and a governance problem for the identities attached to the platform.

Practical implication: Review ecommerce platforms as secret-bearing identity systems and not just application workloads when RCE appears in the wild.

Threat narrative

Attacker objective: The attacker wants to move from a limited foothold to privileged control over the target system, then persist long enough to abuse secrets, administrative functions, or commerce workflows.

1. Entry occurred through an unauthenticated Adobe Commerce RCE and through Windows flaws that could be reached from a local low-privilege foothold.
2. Credential access and control escalation followed when attackers used privilege escalation paths to reach SYSTEM-level access or to execute code inside trusted platform processes.
3. Impact came from persistent compromise of stores and privileged Windows execution, creating exposure for administrative controls, tokens, and sensitive backend systems.

Breaches seen in the wild

• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.
• ASP.NET machine key attacks 2025: Developers copied ASP.NET machine keys from public sources; attackers used one to run Godzilla via ViewState. Microsoft found 3,000+ such keys.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Patch volume is a weak prioritisation metric when active exploitation is already known. The September release shows why teams must sort by exploitability, not by the size of the bulletin. KEV listing, unauthenticated entry, and SYSTEM-level payoff are the real triage variables. Practitioner conclusion: use exposure plus exploit evidence to drive first-hour patch decisions.

Privilege escalation is the real blast-radius amplifier in patch cycles. A local foothold is rarely the end state, but a flaw that reaches SYSTEM changes the defender's problem completely. That is where identity governance intersects with endpoint security: the compromised process can now reach credentials, tokens, and trusted administrative functions. Practitioner conclusion: classify elevation-of-privilege flaws as control-plane incidents, not routine patch backlog items.

Unauthenticated RCE in commerce platforms creates secret exposure risk as much as code-execution risk. The article's Adobe example shows how attackers can turn application execution into access to payment, admin, and deployment secrets. Privileged-path exposure window: the period in which a publicly reachable service can still be used to reach trusted credentials or privileged workflows. Practitioner conclusion: treat any live exploit in a commerce stack as a secrets-governance event.

KEV status should be a governance trigger, not just a vulnerability label. Once CISA adds an issue to KEV, the control question changes from patch planning to containment and blast-radius reduction. That is especially true for systems that carry identity authority, such as update stacks, ecommerce platforms, and API backends. Practitioner conclusion: let KEV drive escalation, ownership, and remediation deadlines across security and infrastructure teams.

From our research library:

• CrowdStrike's 2026 Global Threat Report said zero-days exploited before public disclosure rose 42% year over year.

What this signals

Patch Tuesday triage has to shift from inventory management to attack-path management. The right sequence is to start with live exploitation, then privilege escalation, then the services that carry identity authority. That ordering is especially important for Windows update paths and ecommerce stacks, where a compromise can quickly reach credentials and deployment control.

Privileged-path exposure is the concept teams should operationalise from this release. A vulnerability becomes strategically important when it can reach a trusted component before the organisation can intervene. For identity and access programmes, that means mapping which systems can touch admin tokens, payment secrets, and update privileges, then narrowing those paths before the next exploit lands.

For practitioners

• Prioritise KEV-listed zero-days first Move exploited vulnerabilities to the front of the patch queue when they are already in CISA's KEV catalog or are confirmed in the wild. Focus first on flaws that also grant privilege escalation or unauthenticated code execution.
• Treat SYSTEM-level escalation as a control-plane event Escalation flaws that reach SYSTEM can expose update paths, security tooling, and credentials, so handle them as control-plane risks rather than routine endpoint defects.
• Rotate commerce secrets after live exploitation If Adobe Commerce or a similar platform was reachable during the exploit window, rotate admin credentials, API tokens, payment gateway secrets, database credentials, SSH keys, and deploy keys.
• Separate patching from incident response When a flaw is already exploited before patching exists, treat the affected asset as potentially compromised and investigate persistence, secret access, and abnormal privileged activity before closing the ticket.

Key takeaways

• The September patch release shows that exploitability and privilege impact are better prioritisation signals than raw CVE volume.
• Two exploited Windows zero-days and an actively abused Adobe Commerce RCE illustrate why active attack paths must move first.
• Security teams should treat live exploitation, SYSTEM-level escalation, and secrets-bearing platforms as governance triggers, not just patch items.

Key terms

• Exploited Zero-Day: An exploited zero-day is a software or hardware flaw that attackers are actively using before defenders have a patch or reliable detection. It matters because the weakness is already in play, so exposure exists even when normal security controls appear healthy. In practice, it requires urgent containment, threat hunting, and compensating controls.
• Privilege Escalation: An attack technique where a compromised identity, often an NHI with initially limited permissions, exploits vulnerabilities or misconfigurations to gain elevated access rights, typically leading to broader compromise.
• Remote Code Exploit: A remote code exploit is an attack path that can be triggered over the network without local access to the target device. In this article, the emphasis is not code execution but the ease of exploiting a remotely reachable authentication flaw to gain unauthorized access.
• Exploited vulnerability catalog: An exploited vulnerability catalog is a curated list of flaws known to be used in real attacks. It matters because active exploitation changes priority. In practice, it helps security teams separate theoretical risk from issues that require urgent remediation and tighter operational oversight.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader access and privilege risks that show up in patch-driven incidents like this one.