Patch Tuesday: September 2026 (Expel’s version)

TL;DR

• Microsoft’s September release is the largest in its history: 964 CVEs, 104 rated critical and 860 rated important.
• Two of them are zero-days already exploited in the wild, and CISA added both to its Known Exploited Vulnerabilities (KEV) catalog the same day the patches shipped.
• Elevation of privilege made up 44.7% of this month’s CVEs. Remote code execution (RCE) accounted for another 26.8%.
• Patch the two Windows zero-days first. If you run Adobe Commerce or Magento Open Source, StyleSmuggler (CVE-2026-75650) comes before anything else.

Microsoft shipped 964 CVEs this month. That’s a new record, beating July’s release, which held the previous record. Volume aside, only two of the 964 were exploited before the fix existed. Those are the ones worth losing sleep over. And separate from Patch Tuesday entirely, Adobe spent last weekend responding to an unauthenticated RCE in Adobe Commerce that attackers were already using on live stores. 

Nobody is reading all 964 advisories, so here’s the short list on where to start.

Patch Tuesday: September 8, 2026

Here are the CVEs we think deserve your attention first:

• Windows Update Stack elevation of privilege vulnerability (CVE-2026-81963): A link following weakness lets a local attacker manipulate how a privileged update component resolves a file-system link, so the component acts on the wrong file with elevated permissions. The attacker payoff is SYSTEM level compromise. Microsoft confirmed exploitation in the wild, and CISA added it to the KEV catalog on 9/8/26. Seven Windows Update Stack privilege escalation flaws have been patched since 2022, and this is the first one attackers got to first. The update covers Windows 11, and Windows Server 2025, which narrows the blast radius, but doesn’t lower the priority.
• Windows Advanced Local Procedure Call (ALPC) elevation of privilege vulnerability (CVE-2026-85880): An attacker running code in a low-privilege AppContainer can use this to break out of the sandbox and elevate to SYSTEM level access. That makes it a natural second stage for anything that lands in a sandboxed process first, including browser and document exploits. Also exploited in the wild, also added to the KEV catalog on September 8, 2026. This one hits a much wider spread of both Windows 10 and Windows Server versions than CVE-2026-81963, so expect more effort to patch different versions.

Not Microsoft, but don’t wait: StyleSmuggler in Adobe Commerce

CVE-2026-75650 carries a CVSS of 10.0, needs no authentication, and was under attack before a patch existed. The Sansec Forensics Team, which named it StyleSmuggler, saw exploitation begin on September 4, 2026, three days before Adobe released Hotfix VULN-39341 on September 7.

The technique is clever: an attacker injects PHP through the styles properties in Magento’s template engine, Magento writes that content to disk as part of normal operations, and the code runs when the platform renders the “Payment Transaction Failed Reminder” email template. No credentials, no session backend dependency, and no user interaction.

What comes next is the part that should worry retail and ecommerce teams. On compromised stores, Sansec found a persistent implant that masquerades as a Linux kernel thread, and reuses the process names fc-cache and chronyd. A cron job restarts it every five minutes. Later variants stretched that interval and added arm64 support.

Two things to know:

1. If operationally feasible, apply the hotfix now if you’re running any affected version.
2. The hotfix doesn’t undo a compromise. If your store was reachable during the September 4-7 window, treat this as an incident, not a patch. Adobe recommends rotating the encryption key and everything it protects: admin passwords, REST, SOAP, and GraphQL tokens, OAuth client secrets, payment gateway credentials, database credentials, SSH and deploy keys, and extension API keys.

That’s it for this month. Questions? Reach out to your Expel representative or contact us here.