Record Microsoft patch load includes two exploited Windows gaps
This is a Daily Cyber dot News update, brought to you by Bare Metal Cyber dot com, for Thursday, September 10th, 2026.
Windows administrators face an unusually large patching workload, but two exploited weaknesses provide a clear place to start. Microsoft’s full September security release lists 974 vulnerabilities. After excluding cloud issues and fixes Microsoft applies itself, 964 require customer patching. Two Windows flaws are already being exploited. Both require an attacker to have local access, but they can elevate that access to SYSTEM privileges. The wider release also addresses critical problems across commonly used Microsoft desktop and server components.
This volume makes it impractical to treat every item as equally urgent. SYSTEM access is especially useful after an initial compromise because it can help malware disable defenses, reach protected information, and maintain access. Leaders should protect patching capacity and let technical teams prioritize by actual exposure and attacker activity. Defenders should deploy the cumulative updates, verify that installation succeeded, and begin with internet-exposed, privileged, and business-critical systems. The immediate recommendation is to move the September updates to the front of the Windows remediation queue.
For the sources and the full Daily Cyber newsletter, visit Daily Cyber dot news.
