Notifications
Clear all
Topic starter
14/09/2026 10:09 am
TL;DR: Microsoft’s September release set a new record at 964 CVEs, with 104 critical issues, 860 important issues, and two zero-days already exploited in the wild, while Adobe Commerce’s unauthenticated RCE was attacked before patching, according to Expel. The lesson is straightforward: exploitability and blast radius still matter more than patch volume, especially when credentials and privileged paths are exposed.
NHIMG editorial — based on content published by Expel: Microsoft’s September patch release and the Adobe Commerce StyleSmuggler incident
By the numbers:
- Microsoft’s September release included 964 CVEs, 104 rated critical and 860 rated important.
- Elevation of privilege made up 44.7% of this month’s CVEs.
- Remote code execution accounted for 26.8% of this month’s CVEs.
Questions worth separating out
Q: What breaks when an unauthenticated RCE lands in a system that stores credentials?
A: The boundary between application compromise and identity compromise breaks immediately.
Q: Why do exploited privilege-escalation flaws outrank larger patch backlogs?
A: Because exploit status changes the threat from possible to active, and privilege escalation changes the consequence from local compromise to full system control.
Q: What are the signs that post-exploit persistence is already in place?
A: Look for restart jobs, disguised system processes, unusual kernel-thread impersonation, new binaries surviving reboots, and access patterns that continue after the original exploit vector should have been closed.
Practitioner guidance
- Prioritise exploited privilege-escalation flaws first Rank patches by whether the flaw is already exploited, reaches SYSTEM or equivalent privilege, and sits on an externally reachable path.
- Treat unauthenticated RCE as a credential-exposure event When code execution lands in a platform that stores admin passwords, OAuth client secrets, API keys, or deploy credentials, assume the secret boundary is compromised until each store is verified and rotated.
- Rotate every credential reachable from the compromised trust boundary Follow the compromise path outward from the application to admin accounts, REST and GraphQL tokens, payment gateway credentials, database credentials, SSH and deploy keys, and extension API keys.
What's in the full analysis
Expel's full analysis covers the operational detail this post intentionally leaves for the source:
- Microsoft CVE-by-CVE prioritisation context that helps teams compare this month against previous Patch Tuesday releases
- Adobe Commerce exploitation timing, hotfix sequencing, and the specific compromise window between 9/4 and 9/7
- Credential rotation scope for admin passwords, REST, SOAP, GraphQL, OAuth, payment, database, SSH, and extension keys
- Post-compromise indicators such as persistence artefacts, implant behaviour, and restart mechanisms
👉 Read Expel's analysis of the September Patch Tuesday zero-days and Adobe Commerce RCE →
Patch Tuesday in September 2026: what should teams prioritise first?
Explore further
14/09/2026 10:10 am
Exploitability beats volume in vulnerability governance: A month with 964 CVEs can still have only a handful of issues that define operational risk. The real control failure is assuming all critical and important flaws deserve equal urgency when exploited zero-days and privilege escalation are present. Practitioners should rank by reachable privilege gain, not by advisory volume.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams respond when a public-facing commerce platform may have leaked secrets?
A: Assume the platform’s trust boundary has expanded beyond the web tier and verify every credential it could reach. That means rotating admin, API, database, payment, and deployment secrets, checking for secondary access, and confirming that the attacker did not move from application execution into broader identity reuse.
👉 Read our full editorial: September patch surge exposes why exploited zero-days come first
