Deploy the Windows September update first — two elevation-of-privilege zero-days are being exploited, and between them they cover every supported Windows build. Then five server updates on the five-day clock: SharePoint, Exchange, SQL Server, Skype for Business and Dynamics. Then Office, for two 9.8 flaws that need no click.

Why now. Two flaws in this update are being exploited in the wild, and CISA has given federal agencies until 22 September to close them. Both are local elevations of privilege to SYSTEM, so on their labels they look deferrable: an attacker needs a foothold first. Active exploitation is the reason they cannot wait, and the shape of the two flaws is the reason nobody gets to sit this one out. Microsoft's product lists split them cleanly. CVE-2026-81963, in the Windows Update Stack, affects only Windows 11 (23H2 through 26H1) and Windows Server 2025. CVE-2026-85880, in ALPC, affects only Windows 10 and Windows Server 2012 through 2022 — and it is an AppContainer sandbox escape, the primitive an attacker reaches for after a browser or document exploit lands in a sandbox. Every supported Windows generation therefore carries exactly one exploited zero-day this month, and this update is the only fix for either. The same update is also the only route to 31 unauthenticated, no-interaction 9.8 remote-code-execution flaws, including a DNS Server flaw Microsoft rates 'Exploitation More Likely' — ZDI calls it SigRed's spiritual successor — a Netlogon flaw that gives an unauthenticated attacker code execution on a domain controller, and a Remote Desktop Services flaw, also 'Exploitation More Likely', that Microsoft rated Important rather than Critical. Those are the ways in that the two exploited escalations are built to follow. One deployment closes both halves.

This unit cannot slip. Assessed to cut 3 of the identified chains — see the cut section, where this is labelled as a judgement rather than a finding.

Also inside: 715 CVEs ride this update across its ten KBs — 72 Critical, 31 at 9.8 with a network vector and no privileges or interaction required, and 56 carrying Microsoft's 'Exploitation More Likely' rating. Two honesty notes on the 9.8s. First, for several of them (RPC Runtime, Windows Shell, USB Mass Storage, UxTheme, Media Foundation, Telnet Client, NTFS, Compressed Folder, Windows PDF, RNDIS, XPS, HTTP Print Provider, Event Logging) Microsoft's own advisory says nothing more specific than that an 'in-network attacker calling arbitrary endpoints' could gain code execution; the score says unauthenticated and network, the description does not say how. The flaws Microsoft describes concretely — a crafted packet to a listening service — are DNS Server, Netlogon, MSMQ, RRAS, DHCP Server, SSTP, Internet Connection Sharing, Failover Cluster, NFS and the SMB client, and those are the ones the Exvora AI team treats as this month's substantive entry points. Second, the Hyper-V 9.8 (CVE-2026-69910) is scored unauthenticated-network but its two FAQ answers both describe an attacker inside a guest VM; read it as a guest-to-host escape, not an internet-facing one. Also here: a network-reachable SYSTEM escalation in afd.sys (CVE-2026-70342, 8.1, 'Exploitation More Likely') in the same driver as August's exploited zero-day; a Critical Kerberos and KDC pair on domain controllers (CVE-2026-69676, CVE-2026-69712, both 8.8); a Schannel client flaw (CVE-2026-72940, 8.8, 'Exploitation More Likely') triggered by connecting to a hostile server; nine Critical Windows Hello flaws, eight of them elevation and one a security feature bypass, inside a 64-CVE Windows Biometric Service cluster; and Secure Kernel, VBS and Credential Guard escalations that reach the virtual trust boundary. ZDI counts 20 patches in this release that could be classified as wormable; every one of them is in this update.

Patching is not remediation. Both CVE-2026-81963 and CVE-2026-85880 were exploited as zero-days, before this fix existed, so deployment and compromise assessment are two obligations and this unit discharges only the first. Microsoft has published no attribution and no indication of scale; The Register records 'no word yet on who is exploiting this bug, and to what end'. The shape of the flaws tells you where to look. CVE-2026-85880 is an AppContainer escape: the foothold it completes is a sandboxed process — a browser renderer, an Office document handler, a PDF viewer — so hunt on Windows 10 and Server 2012 through 2022 for AppContainer-hosted processes spawning children at integrity levels they should never reach, and for unexpected SYSTEM-level process creation whose parent chain starts in a user application. CVE-2026-81963 abuses how the Windows Update Stack follows links before it touches files, so on Windows 11 and Server 2025 hunt for reparse points, junctions and symbolic links created by low-privileged accounts under update-staging and servicing paths, and for system components replaced outside a genuine servicing event — Rapid7's inference, not Microsoft's statement, is that the fix stops the update stack from 'overwriting a system component with an attacker-controlled imposter'. On any host where either escalation ran, assume SYSTEM was reached and scope from there.

Then. Deploy the update for each build and reboot. Order inside the unit by role: domain controllers first — DNS Server, Netlogon, Kerberos and the KDC all ride the DC — then any host that exposes Remote Desktop, RRAS or SSTP, MSMQ, NFS, Internet Connection Sharing or Failover Cluster to a segment you do not fully trust, then the rest of the fleet. Where MSMQ, RRAS or NFS are installed but unused, disabling the role or filtering it at the host firewall closes the entry ahead of the reboot window; the SANS Internet Storm Center makes the same recommendation for MSMQ on TCP 1801. Windows Server 2016 needs the servicing stack update KB5122874 installed first and both approved in WSUS, or the security update is not offered. Windows 10 22H2 receives KB5122878 only under Extended Security Updates, and Microsoft published a new ESU licensing preparation package, KB5126256, on 8 September that supersedes the earlier one. Windows Server 2012 and 2012 R2 receive KB5123065 and KB5123066 only under ESU — and that programme's third and final year ends on 13 October 2026, one month from now. Windows 11 26H1 is a new-device-only version and is not offered as an in-place update to existing 24H2 or 25H2 devices; its KB is KB5124012. What will break: one reboot per host, and Microsoft lists no known issues on eight of the ten update pages. The two exceptions are Server 2025 (KB5122871) and Server 2022 (KB5122882), which carry forward an existing WSUS defect — synchronisation error details are not displayed, a function Microsoft removed to fix an older remote-code-execution flaw. Then treat the two exploited flaws as a hunt, not only a patch — see the compromise-assessment note.

Why now. SharePoint is a listed exposed technology: a collaboration server reachable from an untrusted network by design, and the product family that has been exploited more often than any other Microsoft server this year — April's CVE-2026-32201 and July's chain, which Ivanti records as exploited within hours of Rapid7's 11 August write-up. This release ships sixteen SharePoint fixes, six of them network remote code execution, every one requiring an authenticated user. ZDI singles out CVE-2026-69465, a control-safety bypass that makes the server load a code library from a location the attacker controls, as the type of bug recently exploited. None has an exploitation signal yet, which is why this unit sits behind the Windows update rather than beside it — but an internet-facing farm with an unpatched network code-execution flaw is a five-day decision, not a normal-cycle one.

Also inside: Only Subscription Edition receives this update. SharePoint Server 2016 and 2019 left extended support on 14 July 2026 and Microsoft lists no September fix for either; the CVRF product list for every one of the sixteen SharePoint CVEs contains Subscription Edition alone. If you still run 2016 or 2019, there is nothing to deploy — the honest lane is mitigate and monitor, and the fix is migration. Office Online Server receives its own update, KB5002910, in the same cycle.

Then. Installing the Windows update does not patch a SharePoint farm. SharePoint servicing is its own path, with its own change window, its own validation and a Configuration Wizard run after KB5002908 installs. Where a farm is published to the internet, treat this as the five-day structural-Act item it is; where it sits behind an authenticating proxy, the soft call below applies.

Why now. Exchange is the mail edge — exposed technology in the frozen list. CVE-2026-55007 is the flaw to read first: an unauthenticated attacker sends an email with a crafted Visio attachment and the server executes code while it indexes the content. Nobody has to open anything; ZDI notes it does not even need the Preview Pane. Microsoft scores it 8.1 because exploitation is reliable only when the server is under sustained memory pressure, and ZDI's Dustin Childs answers that the way an operator should: the attacker only needs to get it right once. Beside it sit an authenticated code-execution flaw (CVE-2026-69355, 8.8), a 9.3 cross-site-scripting flaw that runs script inside a user's Outlook on the web session from a calendar invitation, and two mailbox-takeover flaws — CVE-2026-69641 for a highly privileged role member and CVE-2026-69380 for any user with a mailbox, which Tenable highlights precisely because its 'Exploitation Less Likely' rating understates what it does. None has an exploitation signal today, so this is a structural five-day item, not an emergency — but unauthenticated code execution on an internet-facing mail server is not something to leave on the normal cycle.

Then. Exchange servicing is its own path, separate from the Windows update. Exchange 2016 and 2019 both left extended support on 14 October 2025 and receive these updates only under Extended Security Updates; Rapid7 records that the ESU arrangement for both is itself due to end in October 2026 after two six-month reprieves. Exchange 2016 CU23 is not affected by CVE-2026-55007 but needs KB5121611 for the other four. If you run 2016 or 2019 without ESU, this unit has no deployable artifact for you and the mitigation lane is the only lane you have.

Why now. SQL Server is core infrastructure — the data platform everything trusts — and this release ships 63 CVEs for it, 24 of them remote code execution. One of those, CVE-2026-47297, is the flaw to read first: Microsoft scores it AV:N/PR:N/UI:N and describes it as deserialization of untrusted data that lets an unauthorized attacker execute code over a network, which on the score alone is an unauthenticated remote takeover of the database host. Its own FAQ then says an authenticated attacker with explicit permissions would have to log in first. The Exvora AI team cannot reconcile the two and does not try: treat any SQL instance reachable from a segment you do not trust as exposed until Microsoft corrects one or the other. Of the remaining 23, twenty need an authenticated SQL principal and three are client-side flaws triggered by connecting to a hostile server. That authentication requirement is the point rather than the comfort: on most estates, application logins held by web tiers are exactly the principals an intruder ends up with, and a crafted query that executes code as the SQL service account turns a stolen connection string into a foothold on the database host. Four of the code-execution flaws are rated Critical — CVE-2026-67631, CVE-2026-67643, CVE-2026-67378 and CVE-2026-67636 — and only CVE-2026-67631, which Microsoft credits to its own red team, reaches every supported version back to SQL 2017; CVE-2026-67643 affects SQL 2022 and 2025 only. The 9.6 is a different animal: CVE-2026-65669 is a prompt-injection flaw in SQL Copilot inside Management Studio 22 — instructions pasted into the assistant bypass its read-only guardrail and act with whatever rights the connected account holds. Automox's line is the right one: a prompt-injection problem wearing a CVE number. It grants no new permission; it exposes the ones already there.

Then. Pick the branch you are on — GDR if you have never installed a cumulative update, CU otherwise — and install the matching KB for each version; SQL 2017 and 2019 GDR and CU updates cover Linux as well. Update Management Studio to the SSMS 22 release that carries the SQL Copilot fix, and until then treat Copilot's read-only mode as advisory: connect it with a read-only login if you want read-only behaviour. Then review which principals can reach each instance from a user-facing tier; that inventory sets the real clock for this unit.

Why now. Skype for Business Server is a collaboration server whose Edge role exists to face the internet, and CVE-2026-66302 is an unauthenticated 9.8: a crafted request writes a file where the attacker chooses and the server runs it. No account, no click. The SANS Internet Storm Center puts it immediately after the two exploited zero-days in its own ordering, alongside MSMQ and RRAS. Ten Skype for Business CVEs ship in this cycle; this one is the reason the unit exists. It is a niche product in 2026, which is exactly why it tends to be the forgotten internet-facing server on an estate that migrated to Teams years ago and never decommissioned the old front end.

Then. Install the September cumulative update for your edition. Microsoft's lifecycle pages show Skype for Business Server 2015 and 2019 both left extended support on 14 October 2025, yet Microsoft lists September fixes for both — confirm your support arrangement before relying on either KB. Then check whether an Edge or reverse-proxy publication for Skype for Business still exists at all; the most common finding is that it does and nobody owns it.

Why now. An on-premises CRM is a published application by design — the frozen list names it as exposed technology — and this release publishes two authenticated code-execution flaws for Dynamics 365 Customer Engagement 9.1, one of them a Critical deserialization bug whose fix Microsoft traces back to July's Service Update 1.46. A CRM login is not a hard thing for an attacker to hold; it is the account class phishing campaigns are built to collect. No exploitation signal, so this is a five-day structural item on any deployment reachable from outside.

Then. Install Service Update 1.48 (KB5123731) on the on-premises deployment. The CVE-2026-65772 fix is older than this cycle: the CVRF's fixed build for it is 9.1.0046.0006, which is Service Update 1.46 from July 2026, so a deployment at 1.46 or later already has it and 1.48 carries it forward. Dynamics 365 online tenants are Microsoft's to patch and need nothing from you.

Why now. 108 CVEs ship for Office this month by Microsoft's own product tags, 20 of them Critical — 22 if the two Windows Graphics Component flaws that also list Office products are counted, which is CrowdStrike's figure — and two of them change what 'client-side' means. CVE-2026-78509 executes when Outlook draws a crafted message in the Reading Pane: Microsoft's own words are that the recipient does not open the message and does not click anything in it. CVE-2026-78510 executes when the Windows Explorer preview pane renders a crafted RTF file, and Microsoft states in that advisory that the Preview Pane is an attack vector. Both score 9.8, both come from the same researcher, Haifei Li of EXPMON, and neither has an exploitation signal. CrowdStrike counts 22 Critical Office patches this month and 12 of them exploitable through a preview or reading pane. The rest of the unit is the familiar Office shape — 38 Word and 32 Excel fixes, Critical 8.8s that need a user to open a file — and would sit on the normal cycle. The two zero-click flaws are why it does not.

Also inside: Microsoft's advisory for CVE-2026-78509 contradicts itself: one answer says viewing the message in the Outlook Reading Pane triggers the flaw without opening or clicking, the next says the Preview Pane is not an attack vector. The Exvora AI team reads the first as Outlook's Reading Pane and the second as the Windows Explorer Preview Pane — two different panes — and treats the Outlook one as the operative statement, because it is the specific one. Microsoft 365 Apps updates do not arrive through Windows Update; they arrive as new builds from the Office content network on each update channel's schedule, and the installer cannot apply one while an Office program is open. For Office 2016 the MSI packages are per application — the Outlook Reading Pane fix is in the Word 2016 update, KB5002923, because Word is Outlook's rendering engine. One more RTF-preview flaw does not live in this unit at all: CVE-2026-77493, a 9.8 in the Windows Graphics Component with the same 'opens the file or it is rendered in the preview pane' description, ships in the Windows update. Patching Office alone leaves it open; that is one more reason the Windows update is rank 1.

Then. Push the September build on every Click-to-Run channel and install the Office 2016 MSI updates, Word and the shared Office update first. Office for the Mac has no fix yet: Microsoft states the updates for Office LTSC for Mac 2021 and 2024 will follow as a revision to the advisory, and the CVRF lists no remediation for Microsoft 365 for Mac either. Until it lands, Mac fleets are in the mitigate-and-monitor lane for both 9.8s: turn off the Outlook Reading Pane or read mail in Outlook on the web, and disable file preview and block RTF at the mail gateway. Protected View does not help here, because the Word flaw fires on preview rather than on open. That is the abstraction leak the model warns about — a fix exists for the CVE but not for every product that carries it.

Disposition. Microsoft states for each of these CVEs that the vulnerability 'has already been fully mitigated by Microsoft. There is no action for users of this service to take'; they are published for transparency under Microsoft's cloud-service CVE policy. There is nothing to deploy, so the tree does not run.

Why now. Nothing here needs deploying, and that is the point of recording it. The two CVSS-10.0 entries in this release — Azure AI Language and Azure AD B2C — and the 9.9 in Entra ID are cloud services Microsoft fixed on its own side before publishing; the CVE exists for transparency. A severity-sorted queue would put them at the top and then discover there is nothing to do. The identity ones deserve a second look for a different reason: a Microsoft-side authorization flaw in Entra ID or B2C is a tenant-exposure event even after it is fixed, and the advisory does not say whether it was ever exercised. Ask your Microsoft account team; the patch queue cannot answer it.

Then. No deployment. Check Entra sign-in and audit logs for the window before 8 September if your tenant relies on B2C or on the Entra features the two advisories describe.

Why now. Developer tooling is neither exposed technology nor core infrastructure, and every flaw here needs a developer to open something — a workspace, a project, a file — so the tree files the unit on the normal cycle. The 9.6 is worth knowing about anyway: CVE-2026-81376 lets a crafted VS Code workspace bypass Workspace Trust, the one control that stands between cloning an untrusted repository and running its code. That is the entry shape of every developer-targeting supply-chain campaign of the last three years, and a developer workstation is the pivot that holds signing keys, cloud tokens and pipeline credentials. Normal cycle, but a short one.

Then. Update VS Code and Visual Studio through their own channels, and the .NET runtimes per version; the .NET Framework fix ships as a per-OS cumulative update alongside the Windows update. Ten VS Code fixes ship this month in total, eight of them security feature bypasses, and four of those name Workspace Trust specifically.