What This Month’s Patch Tuesday Vulnerabilities Mean for Your Business

If your IT team is drowning in this month’s Patch Tuesday vulnerabilities, you are not imagining the scale of it. Microsoft’s 8 September 2026 release covered 974 security holes, according to KrebsOnSecurity. Of those, 113 are rated critical. It is the largest single batch the company has ever shipped. You will not patch all of it in a day. Here is a practical order to work through it.

Step one: fix the Patch Tuesday vulnerabilities already exploited

Two flaws in this release have confirmed real-world attacks against them. They come first, regardless of anything else on your list. CVE-2026-81963 sits in the Windows Update Stack. CVE-2026-85880 affects Windows ALPC, the internal channel Windows processes use to communicate. Both let an attacker who already has limited access on a machine escalate to full control. That limited access might come from a phished credential or a compromised app. If your patch management process has any fast-track lane for actively exploited bugs, this is what it exists for.

Step two: close the unauthenticated, no-click holes

Next, look at the bugs that need no user interaction and no valid credentials at all. Cisco Talos and KrebsOnSecurity both flagged CVE-2026-69730, a Windows DNS Server flaw scored 9.8, as remotely triggerable by an unauthenticated attacker. CVE-2026-69829, a Windows Shell remote-code-execution bug, carries the same score. If you run Azure AD B2C, add CVE-2026-83711 to this list too. Talos rated it a maximum 10.0. The Zero Day Initiative’s review counted roughly 20 bugs across this release that it considers wormable. They sit in DNS Server, DHCP Server, Message Queuing and Netlogon, and can move machine to machine without anyone clicking anything. Those services are usually reachable from inside your network even where they are not exposed to the internet. Treat them as high priority on internal servers too, not just your perimeter.

Step three: check your e-commerce platform

Adobe issued its own 172 fixes the same day, across ten bulletins, and one is already under attack. CVE-2026-75650 is a maximum-severity template-injection flaw in Adobe Commerce, the platform underneath many Magento stores. If your business runs an online shop on that stack, this patch jumps to the front of the queue alongside Microsoft’s exploited bugs. Template-injection flaws in storefront software have a habit of turning into skimmers within days of disclosure.

Step four: work through the rest on a normal cycle

Everything else in this release can follow your usual patching schedule. That includes the remaining critical and important-rated bugs among this month’s Patch Tuesday vulnerabilities. Trying to deploy several hundred fixes at once across a live business is how outages happen. For most small and mid-sized organisations, an outage from a rushed patch does more damage than a theoretical exploit that has not appeared yet. Test in a staging environment where you have one. Stagger the rollout across your estate rather than pushing everything at once.

A sensible cadence for most small and mid-sized organisations is: exploited bugs within 24 to 48 hours, unauthenticated critical bugs within a week, and everything else within your normal monthly or fortnightly window. Write that cadence down if you have not already. When a release this size lands, having the order agreed in advance saves an argument about priorities on the day. It also means whoever is on call does not have to guess what counts as urgent at nine o’clock on a Tuesday night.

Where testing fits in

Patching answers the question “did we apply the fix.” It does not answer a different question: could an attacker still get from a low-privileged account to domain admin using a chain of smaller issues? That is what an internal network penetration test is built to answer. It actually attempts the kind of privilege-escalation path that bugs like the ALPC and Update Stack flaws represent.

If your vulnerability management process is mostly a scanner dashboard, this is a good month to ask who is deciding what to do with the results, not just watching the number go down. And if you are not sure your external-facing systems are even fully mapped, including anything DNS or remote-access related, an external attack surface review is the sensible step before the next penetration test. Because so many of this month’s fixes touch DNS, remote access and directory services, an outdated map of what you actually run is the easiest way to miss one that matters.

None of this replaces patching. Fast, prioritised patching is still the first line of defence against this month’s Patch Tuesday vulnerabilities, and the two exploited bugs need attention today, not next week.