Patch Tuesday priorities: why the exploited CVE is the one to fix

TL;DR: Microsoft shipped 971 fixes, but the only vulnerability already being exploited in the wild has no CVSS score and is rated Important, underscoring how severity labels can mislead patch prioritisation, according to Absolute Security's September 2026 Patch Tuesday analysis. Attack-chain context, not abstract scorecards, should drive triage when exploitability and foothold-to-control escalation are what matter.

Editorial analysis by NHI Mgmt Group, based on content published by Absolute Security: “September 2026 Patch Tuesday: The Only Exploited CVE Had No CVSS Score”.

By the numbers:

• Microsoft shipped 971 fixes in September, including 112 Critical vulnerabilities and 1 Low vulnerability, according to Absolute Security.
• Microsoft's SharePoint release included 16 CVEs spanning remote code execution, elevation of privilege, spoofing and information disclosure, according to Absolute Security.

Key questions

Q: What breaks when an exploited vulnerability has no CVSS score but does have active exploitation?

A: Severity labels stop being a reliable queueing tool when a flaw is already being used in the wild.

Q: Why do preview-pane vulnerabilities change endpoint risk so quickly?

A: Because they remove a major friction point between delivery and execution.

Q: How do security teams decide whether to patch a high-score vulnerability first?

A: Teams should compare exploitability, current attack activity, and the vulnerability's place in the chain rather than relying on score alone.

Practitioner guidance

• Patch exploited EoP flaws first Move actively exploited elevation-of-privilege issues to the front of the queue even when they are not the highest-scored items.
• Treat preview panes as execution surfaces Review whether Outlook and Office preview functionality is required for all user groups, then harden or constrain it where possible.
• Separate service-side mitigations from local patches Create a triage step that filters out CVEs already fully mitigated by the vendor on the service side before you assign endpoint work.

Bottom line: The article shows that a lower-rated flaw can matter more than a Critical one when it is already being exploited and can turn a foothold into SYSTEM control.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →