Patching

Microsoft's September 8 release fixed 974 CVEs, the largest single month on record. Two of them were already being exploited, and 20 more were rated wormable. Some trackers count slightly fewer (964 to 973) depending on what they include. Either way, no team tests and deploys nearly a thousand fixes in one go.

More than two weeks later, many estates are still partway through. The US federal deadline for the two zero-days passed on September 22. If yours are not done, this is the order we would work in.

Tier 1, today: what is already exploited

CVE-2026-85880, Windows ALPC. A heap buffer overflow in Advanced Local Procedure Call that lets a local attacker become SYSTEM.

CVE-2026-81963, Windows Update Stack. A link-following flaw in the components that install Windows updates, which also leads to SYSTEM.

Both need an attacker to be on the machine already, so neither is the way in. They are how a foothold from a phishing email or a stolen login becomes full control of the machine, and ransomware crews use exactly that step. Both are on the CISA KEV list.

Add the browser to this tier. Google's Chrome 153.0.8010.36, released the same day, fixed CVE-2026-87491, an out-of-bounds write in the V8 engine with a known exploit in the wild. It allows code execution inside the sandbox from a crafted web page. Make sure Chrome is on that version or later and that Edge has taken its matching update. Browsers that have not been restarted since the update are still running the old code.

Tier 2, this week: wormable server roles

A flaw is wormable when it can be reached over the network, needs no login and needs no one to click anything. One infected server can then attack the next on its own. This month has 20 of them, mostly in server roles:

• DNS Server, including CVE-2026-69730 at CVSS 9.8, which researchers are comparing to 2020's SigRed
• DHCP Server, which alone received 36 fixes this month
• Netlogon, RRAS, SSTP, SMB, NFS, Message Queuing and Failover Cluster

Start with domain controllers, which usually run DNS and sometimes DHCP, then your other infrastructure servers. If a role is installed but not used, removing it is a better fix than patching it.

Tier 3, next: anything facing the internet

The Zero Day Initiative ranked this month's Exchange Server fixes near the top of its list. Patch Exchange and any other Microsoft service that can be reached from outside, then move on to Office and the rest of the client estate.

Tier 4, normal cycle: everything else

The rest can go through your usual testing rings. One known issue to watch: Microsoft warned that this month's updates can break Always On VPN connections on some Windows 11 systems. Test on a VPN user before a wide rollout, so a VPN outage does not become the reason the whole update is held back.

Know your estate before release day

With nearly a thousand fixes in a month, "patch everything within 30 days" is not a workable rule. It helps a lot to know before release day which machines face the internet, which server roles run where, and which machines are domain controllers. With that list in hand, sorting a release into the tiers above is quick.

If you do not have that list, our attack surface management work builds it, and our on-demand risk reduction team can help clear a backlog. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: SecurityWeek, Security Affairs, CrowdStrike analysis, Malwarebytes, Security Affairs on Chrome.