Topic starter
14/09/2026 10:09 am
TL;DR: Microsoft’s September release set a new record at 964 CVEs, with 104 critical issues, 860 important issues, and two zero-days already exploited in the wild, while Adobe Commerce’s unauthenticated RCE was attacked before patching, according to Expel. The lesson is straightforward: exploitability and blast radius still matter more than patch volume, especially when credentials and privileged paths are exposed.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Patch Tuesday: September 2026 (Expel’s version)”.
By the numbers:
- Microsoft rated 104 issues critical in the September release.
- Microsoft rated 860 issues important in the September release.
- Elevation of privilege made up 44.7% of the month's CVEs.
Key questions
Q: How should security teams respond when a zero-day is likely to have been exploited already?
A: Treat the issue as an active containment event, not just a patching task.
Q: Why do privilege escalation flaws deserve higher priority than the total CVE count suggests?
A: Because the business risk comes from the result of escalation, not from the number of advisories.
Q: How can security teams tell whether a patch issue has become a compromise issue?
A: Look for evidence that the affected system was reachable before remediation, whether exploitation was confirmed in the wild, and whether the flaw could expose privileged paths or secrets.
Practitioner guidance
- Prioritise KEV-listed zero-days first Move exploited vulnerabilities to the front of the patch queue when they are already in CISA's KEV catalog or are confirmed in the wild.
- Treat SYSTEM-level escalation as a control-plane event Escalation flaws that reach SYSTEM can expose update paths, security tooling, and credentials, so handle them as control-plane risks rather than routine endpoint defects.
- Rotate commerce secrets after live exploitation If Adobe Commerce or a similar platform was reachable during the exploit window, rotate admin credentials, API tokens, payment gateway secrets, database credentials, SSH keys, and deploy keys.
Bottom line: The September patch release shows that exploitability and privilege impact are better prioritisation signals than raw CVE volume.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
Patch volume is a weak prioritisation metric when active exploitation is already known. The September release shows why teams must sort by exploitability, not by the size of the bulletin. KEV listing, unauthenticated entry, and SYSTEM-level payoff are the real triage variables. Practitioner conclusion: use exposure plus exploit evidence to drive first-hour patch decisions.
A few things that frame the scale:
- CrowdStrike's 2026 Global Threat Report said zero-days exploited before public disclosure rose 42% year over year.
A question worth separating out:
Q: What is the difference between a high-severity vulnerability and an exploitable attack path?
A: A high-severity vulnerability may be serious on paper, but an exploitable attack path is one attackers are already using or can use immediately. The latter deserves faster action because it combines severity, reachability, and active abuse, which is what turns patching into an urgent governance decision.
👉 Read our full editorial: September patch surge exposes why exploited zero-days come first