September Patch Tuesday: are exploited flaws changing patch priority?

TL;DR: September 2026 Patch Tuesday analysis counts 973 Microsoft CVEs, including 113 Critical issues, 58 marked Exploitation More Likely, and two confirmed exploited flaws, according to Automox, with Windows Update Stack and Outlook bugs highlighting how local privilege escalation and zero-click code execution reshape patch order. Exploitation status, exposed service reachability, and update-state drift now matter more than severity alone.

Editorial analysis by NHI Mgmt Group, based on content published by Automox: “A Record 973 CVEs, an Exploited Windows Update Stack Flaw, and an Outlook Bug That Fires from the Reading Pane”.

Key questions

Q: What should security teams do first when Patch Tuesday includes exploited zero-days?

A: Start with the vulnerabilities confirmed in active exploitation, then move to systems that are internet-facing, privilege-bearing, or support authentication and administration.

Q: Why do local privilege escalation bugs create more risk than the score suggests?

A: Because they turn a limited foothold into SYSTEM-level control, which lets an attacker tamper with services, access additional credentials, and prepare lateral movement.

Q: What are the signs that Office or Windows patching is drifting out of control?

A: Look for endpoints that report generally healthy but still show stale build numbers, downloaded Office updates waiting on an application close, or unclear update status for the Windows stack.

Practitioner guidance

• Prioritise exploited flaws before severity tiers Move confirmed exploited issues and zero-click execution bugs ahead of purely scored Critical items, especially where the affected service can be reached broadly or controls privileged infrastructure.
• Verify update state directly on endpoints Check installed build numbers on Windows and Office clients rather than assuming the patch landed because the device reports generally healthy status.
• Restrict reachability to exposed services Limit who can reach DNS, Remote Desktop Services, and similar high-value management surfaces while fixes roll out, and validate exposure from user and remote-access networks.

Bottom line: September's Patch Tuesday shows that active exploitation and exposed service reachability now matter more than CVSS when teams decide what to fix first.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →