Skip to content
ERP LEADERS
Subscribe to the brief Follow on LinkedIn

The news behind the software that runs companies, explained for everyone.

Security

Microsoft patched 974 flaws this month. Four are already under attack.

The Register called this month's September Patch Tuesday count a record.

ERP LEADERS news desk · · First reported by The Register · Edition no. 4
Photo: Coolcaesar/Wikimedia, CC BY-SA 4.0

On 9 September 2026, Microsoft issued 974 CVEs. In the whole of 2025 it issued 1,130.

Four flaws in the month's disclosures are under active exploitation, according to the report, and two of them are Microsoft's. CVE-2026-85880 and CVE-2026-81963 are Windows privilege escalations. CVE-2026-75650, called StyleSmuggler, allows remote code execution in Adobe Commerce and Magento. CVE-2026-85046 is a Chrome V8 flaw that was still unpatched in Edge when the article was published.

Microsoft wrote of CVE-2026-85880: "An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system. No additional user interaction is required."

CISA gave United States federal civilian agencies until 22 September for the two Windows flaws. The deadline for the Adobe one was 11 September. The Register puts the rising counts down to AI-driven bug hunting.

Your change board approves a fixed number of emergency windows a month. What happens to the rest?

Sources

Spotted an error? Tell us. Every correction is logged on Standards.

Your reading room

Companies in this story
MicrosoftAdobe

Our file on Microsoft

  1. 4 NovFiled later

    Microsoft and Google are not in the school platform six German states agreed to buy. Nextcloud supplies the software.

  2. 4 NovFiled later

    Microsoft says 8 GB Windows 11 PCs will multitask up to 40% faster. IT teams buying laptops face rising memory prices.

  3. 3 NovFiled later

    Microsoft calendars can be an hour off after a Canadian clock change. A fix for recurring meetings has no date yet.

  4. 2 NovFiled later

    Microsoft, Oracle and three peers cut buybacks 83% to $13.6bn. AI spending is eating their cash, a Reuters analysis found.

  5. 2 NovFiled later

    Microsoft's new reseller Copilot seats can add usage charges to the $21 monthly fee. The default cap is 4,000 credits per user.

All 70 Microsoft stories

For your next steering committee

Questions for your own programme. They are not findings about any company in this story.

  1. 1Ask when systems of this kind in your landscape were last patched, and who confirms it.
  2. 2Ask which finance and ERP accounts can be reached from outside, and how each sign-in is protected.
  3. 3Ask how long a restore took the last time it was tested.

Issue 01 of the ERP LEADERS brief puts a timeline, the three-number review and six questions on one page. Read issue 01

Founding reader view is on in this browser. It is a reading view, not secure access. Print the working sheet

Founding reader

Welcome back. · Issue 01

1 comment under this story on LinkedIn. Read the discussion

Keep reading

The ERP LEADERS brief Subscribe