September patch wave exposes exploited zero-days and access risk

At a glance

What this is: Blackpoint Cyber’s September 2026 Patch Tuesday overview highlights more than 950 Microsoft vulnerabilities, plus exploited Windows elevation-of-privilege zero-days and urgent SAP, Adobe and Cisco fixes.

Why it matters: It matters because patch prioritisation now has to account for confirmed exploitation, unauthenticated attack paths and privilege escalation risk across both infrastructure and application estates.

By the numbers:

• Microsoft’s September 2026 Patch Tuesday addressed more than 950 vulnerabilities, its largest release to date.
• SAP released 19 new Security Notes as part of its September 2026 Security Patch Day.

Context

Patch Tuesday has become less about routine maintenance and more about compressing exposure windows across operating systems, enterprise applications and network devices. The practical problem is not just volume, but the mix of confirmed exploitation, unauthenticated attack paths and post-compromise privilege escalation that forces teams to separate patch urgency from patch count.

For identity and access teams, the key issue is that several of these flaws convert ordinary authenticated access into administrative control, while others let unauthenticated attackers register components or execute code before normal controls can intervene. That makes patching an access-governance issue as much as a vulnerability-management one, especially where vulnerability management has to inform emergency prioritisation.

Key questions

Q: How should security teams respond when a zero-day is likely to have been exploited already?

A: Treat the issue as an active containment event, not just a patching task. Prioritise isolation of exposed systems, review privileged access paths, and check for persistence in both human and non-human accounts. The aim is to reduce the attacker’s reach before remediation is complete, because patch availability does not mean the environment is still clean.

Q: Why do local privilege escalation bugs create more risk than the score suggests?

A: Because they turn a limited foothold into SYSTEM-level control, which lets an attacker tamper with services, access additional credentials, and prepare lateral movement. The score measures vulnerability impact, but the operational risk comes from how much trust the attacker can take over once the flaw is used.

Q: What breaks when unauthenticated enterprise application services are exposed to the internet?

A: The trust boundary breaks first. If a message server, kernel component or similar service accepts hostile input without strong authentication and network restriction, an attacker can register rogue components, execute code or manipulate backend processes before normal defences react. In practice, segmentation and service hardening become as important as the patch itself.

Q: When should organisations rotate credentials after suspected secret exposure?

A: Rotate as soon as a credential is suspected to be exposed, but do it in a controlled sequence. First identify every place the secret is used, then revoke or replace it upstream, redeploy dependent services, and verify the new value is live. Waiting for perfect certainty usually extends attacker dwell time.

Technical breakdown

Why exploited elevation-of-privilege flaws change the response model

Elevation-of-privilege vulnerabilities are different from many remote code execution bugs because they often assume the attacker already has a foothold. In this case, Microsoft’s Windows flaws let an authenticated attacker move from standard access to SYSTEM, which means the vulnerability becomes a force multiplier after compromise rather than an initial intrusion vector. That distinction matters operationally: the real question is not only whether a patch exists, but whether a local foothold can be turned into full control before detection and containment catch up. See the Zero-Day and Exploited Vulnerabilities Guide. See the Zero-Day and Exploited Vulnerabilities Guide.

Practical implication: Prioritise post-compromise privilege escalation fixes ahead of ordinary backlog work when exploitation is already confirmed.

How unauthenticated enterprise application flaws widen blast radius

SAP’s critical findings show a different pattern. One flaw allows unauthenticated remote code execution through deserialization failure, while another lets an unauthenticated attacker register a rogue component in the message server path. Both collapse trust boundaries at the system edge, which is why the attack surface is not limited to a single server. In large ERP environments, unauthenticated access combined with kernel or message-server reach can expose data, processes and credential material at once. The governance issue is not just patch level, but whether the application perimeter is designed to assume hostile network traffic. See the Vulnerability Management Guide. See the Vulnerability Management Guide.

Practical implication: Treat externally reachable ERP and middleware services as high-priority exposure points until authentication and segmentation are verified.

Why attacker tradecraft now blends exploitation with credential harvesting

The Adobe Commerce issue shows how exploitation rarely stops at code execution. Blackpoint Cyber says active abuse has been used to deploy backdoors, and it also notes credential rotation for administrator, API, OAuth, database and SSH accounts. That combination matters because attackers use code execution to preserve access, then pivot into identity material that lets them return without re-exploiting the original flaw. This is where vulnerability management and [[L4|privileged access management]] overlap: the patch closes the defect, but credential hygiene limits how far the compromise can spread if the window was already opened. See the Privileged Access Management Guide.

Practical implication: Rotate privileged and service credentials immediately when exploitation is confirmed, not only after patch deployment.

Threat narrative

Attacker objective: The attacker aims to convert vulnerable software exposure into durable administrative access, persistence and broader control of enterprise systems.

1. Entry occurs through exploited software flaws, including unauthenticated remote code execution paths and an authenticated Windows privilege escalation path.
2. Credential access and privilege escalation follow when attackers use code execution or local footholds to reach administrative control, backdoors or credential material.
3. Impact includes root-level control of exposed systems, modified binaries, backdoors and the possibility of lateral movement across enterprise environments.

Breaches seen in the wild

• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.
• Gravity SMTP CVE-2026-4020 API Keys Exposure: CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Patch severity is no longer enough to describe priority. This bulletin shows why confirmed exploitation and access-path shape matter more than vendor severity labels alone. A lower-rated flaw with active abuse can be more urgent than a nominally critical issue with no evidence of exploitation. Practitioners should treat patch triage as a live access-risk exercise, not a scorekeeping exercise.

The governance failure is the assumption that authentication boundaries will hold during exploitation. SAP’s unauthenticated registration issue and Adobe’s backdoor deployment both show that software trust boundaries can be collapsed before normal control layers respond. That is why the operational unit is not the patch in isolation, but the exposure path that made the compromise possible.

Credential rotation becomes a containment control when exploitation is confirmed. Blackpoint Cyber’s recommendation to rotate administrator, API, OAuth, database and SSH credentials reflects a simple reality: code execution often turns into identity compromise. When attackers can harvest or reuse secrets, the patch only closes one door while leaving another open.

Zero-day pressure is producing a faster convergence between vulnerability management and identity governance. As unauthenticated flaws, local privilege escalation and credential theft increasingly appear in the same incident path, teams need shared prioritisation logic across patching, PAM and service-account hygiene. The practical implication is that vulnerability workflows must now account for who or what can be controlled after the defect is exploited.

What this signals

Patch prioritisation is becoming an access-governance decision. When the same bulletin includes confirmed exploitation, unauthenticated entry points and local privilege escalation, the response model has to shift from calendar-based patching to exposure-based control. Teams should expect tighter coupling between vulnerability operations, PAM and service-account governance in the next planning cycle.

Credential rotation will increasingly follow exploitation confirmation, not just patch completion. Once a flaw can be used to deploy a backdoor or harvest credentials, the residual risk lives in the identities that survive the patch. That means the programme signal is clear: identity hygiene is no longer a downstream clean-up task, but part of first-line incident containment.

Exploited vulnerability triage is now a visibility problem as much as a remediation problem. The organisations that move fastest will be those that can map internet exposure, privileged accounts and active exploitation evidence into one decision path. Without that connection, patch queues will keep reflecting asset ownership instead of real attack pressure.

For practitioners

• Prioritise exploited flaws ahead of severity labels Move confirmed-in-the-wild issues and unauthenticated remote code execution paths to the front of the remediation queue, even when the vendor assigns a lower rating than other unexploited issues.
• Isolate externally reachable SAP services Restrict internet exposure of SAP ICM and Message Server ports, and verify that kernel services are not directly reachable from untrusted networks.
• Rotate privileged credentials after confirmed exploitation Reset administrator, API, OAuth, database and SSH credentials where active exploitation is confirmed, and review which service accounts may have been exposed through the compromise.
• Use compensating controls until fixed builds are deployed Apply temporary mitigations such as Cisco iACLs or Live Protect shields where patching cannot be completed immediately, and document the residual exposure window.

Key takeaways

• This bulletin highlights a combined risk pattern: exploited Windows privilege escalation, unauthenticated SAP access paths and active Adobe exploitation all compress the time available to respond.
• The evidence matters because Microsoft’s release exceeded 950 vulnerabilities and included two zero-days confirmed in the wild, while SAP, Adobe and Cisco each added urgent remediation pressure.
• The limiting control is not patching alone. Teams need exposure reduction, privilege control and immediate credential rotation when exploitation has already crossed into the environment.

Related NHI Mgmt Group resources: Zero-Day and Exploited Vulnerabilities Guide · Vulnerability Management Guide · Privileged Access Management Guide · Break-Glass and Emergency Access Account Guide

Key terms

• Elevalation of Privilege: A vulnerability class that lets an attacker move from a lower permission level to a higher one, often from a foothold to administrative control. The key risk is not initial access but the ability to turn limited compromise into system-level authority.
• Zero-Day Exploitation: Zero-day exploitation is the use of a vulnerability before a fix is available or widely applied. Attackers exploit the unknown weakness to bypass normal defences, so defenders rely on layered controls, anomaly detection, hardening, segmentation, and rapid containment while patches and mitigations are developed.
• Backdoor Persistence: Backdoor persistence is the ability of malicious model logic to survive transformations such as conversion or downstream retraining. It matters because a backdoor that remains effective after routine lifecycle steps cannot be treated as a temporary training defect.
• Compensating Control: A compensating control is a measure that reduces risk when the ideal fix, such as immediate patching or redesign, is not possible. In OT, compensating controls often include session recording, access restriction, and tighter monitoring. They do not eliminate the underlying issue, but they narrow exposure until safer remediation can happen.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is suited to practitioners who need to connect identity governance with vulnerability management, privileged access and machine identity control.