Topic starter
23/10/2026 12:47 am
TL;DR: 971 fixes show why the exploited flaw mattered most in Absolute Security's Patch Tuesday case work. Patch queues should follow active exploitation and attack-chain position, not CVSS alone, when a lower-rated issue can reach SYSTEM control.
Editorial analysis by NHI Mgmt Group, based on content published by Absolute Security: “September 2026 Patch Tuesday: The Only Exploited CVE Had No CVSS Score”.
By the numbers:
- Microsoft shipped 971 fixes in September, including 112 Critical vulnerabilities and 1 Low vulnerability, according to Absolute Security.
- Microsoft's SharePoint release included 16 CVEs spanning remote code execution, elevation of privilege, spoofing and information disclosure, according to Absolute Security.
Key questions
Q: Why do preview-pane vulnerabilities change endpoint risk so quickly?
A: Because they remove a major friction point between delivery and execution.
Q: How do security teams decide whether to patch a high-score vulnerability first?
A: Teams should compare exploitability, current attack activity, and the vulnerability's place in the chain rather than relying on score alone.
Q: What breaks when an exploited vulnerability has no CVSS score but does have active exploitation?
A: Severity labels stop being a reliable queueing tool when a flaw is already being used in the wild.
Practitioner guidance
- Patch exploited EoP flaws first Move actively exploited elevation-of-privilege issues to the front of the queue even when they are not the highest-scored items.
- Treat preview panes as execution surfaces Review whether Outlook and Office preview functionality is required for all user groups, then harden or constrain it where possible.
- Separate service-side mitigations from local patches Create a triage step that filters out CVEs already fully mitigated by the vendor on the service side before you assign endpoint work.
Bottom line: The article shows that a lower-rated flaw can matter more than a Critical one when it is already being exploited and can turn a foothold into SYSTEM control.
Glossary terms: Exploit Position, Attack Surface Reduction, Elevalation of Privilege, Preview-Triggered Execution
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Exploit status has become the more operationally useful risk signal than CVSS. Scores still matter for comparison, but they are secondary when an attacker is already using a flaw in the wild. For practitioners, the governance problem is not lack of scoring, it is over-trusting scoring as a queueing mechanism.
A question worth separating out:
Q: Should organisations treat vendor-remediated service vulnerabilities the same as local patch work?
A: No. If the vendor has already fixed the issue on the service side, the response changes from patch execution to risk verification and reporting. Local remediation effort should stay focused on defects that still require customer action and still change exposure.
👉 Read our full editorial: September 2026 Patch Tuesday shows why exploit status beats CVSS
This post was modified 6 days ago by NHI Mgmt Group