<p>Microsoft’s September 2026 Windows security updates deserve more attention than a routine Patch Tuesday.</p>

<p>The September 8 release addresses two Windows vulnerabilities that were already being exploited in real attacks. At the same time, researchers identified a significant group of additional Windows vulnerabilities capable of remote code execution, including some that may require neither authentication nor user interaction.</p>

<p>For business leaders, the important question is not how many vulnerabilities Microsoft fixed this month. It is whether the systems that matter to your business are actually receiving the right updates quickly, successfully, and with enough validation to prove the risk has been reduced.</p>

<h2>What changed in the September Windows updates?</h2>

<p>Microsoft released its September security updates on September 8, 2026. The broader Microsoft release addresses hundreds of vulnerabilities across Windows, Office, Exchange, SQL Server, SharePoint, Azure, and other products.</p>

<p>Windows represents a substantial portion of the release, but two vulnerabilities deserve immediate attention because Microsoft and the U.S. Cybersecurity and Infrastructure Security Agency, or CISA, have confirmed that they have been exploited.</p>

<ul>
<li><strong>CVE-2026-81963</strong> affects the Windows Update Stack and can allow an attacker who already has some level of local access to elevate privileges to SYSTEM.</li>
<li><strong>CVE-2026-85880</strong> affects Windows Advanced Local Procedure Call, or ALPC, and can also allow a local attacker to elevate privileges to SYSTEM.</li>
</ul>

<p>SYSTEM is one of the highest privilege levels available in Windows. These vulnerabilities are therefore particularly useful to an attacker who has already obtained an initial foothold through another vulnerability, malicious attachment, compromised account, or other technique.</p>

<p>That distinction matters. Neither vulnerability should automatically be interpreted as an attacker being able to compromise every Windows computer directly from the internet. Their value to an attacker is that they can help turn limited access into much greater control of an affected system.</p>

<p>CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on September 8 based on evidence of active exploitation. That moves them from theoretical security concerns to vulnerabilities organizations should treat as remediation priorities.</p>

<h2>The headline vulnerability count is not the most useful metric</h2>

<p>This month’s Microsoft release is unusually large. Different security organizations have reported slightly different totals because they use different methods for counting newly released, previously disclosed, republished, and third-party vulnerabilities.</p>

<p>For a business, that accounting distinction is far less important than understanding which vulnerabilities affect systems you actually operate.</p>

<p>Security researchers reviewing the September release identified roughly 20 vulnerabilities with characteristics that could make them particularly serious: remote code execution without authentication or user interaction. Affected technologies include Windows components associated with DNS, DHCP, Active Directory Domain Services, Remote Desktop Services, Netlogon, SMB, failover clustering, and other infrastructure.</p>

<p>These vulnerabilities are not all known to be under active attack. That distinction is important. They do, however, reinforce why server patching and workstation patching cannot be treated as identical exercises.</p>

<p>A vulnerability affecting a lightly used workstation presents a different business risk from one affecting a domain controller, Remote Desktop server, DNS server, or other system that provides foundational services to the organization.</p>

<h2>What businesses should be asking their IT teams</h2>

<p>A mature patch-management conversation should go beyond asking whether “Windows updates are automatic.”</p>

<p>Leadership should be able to get clear answers to questions such as:</p>

<ul>
<li>Have the September Windows security updates been tested and approved for deployment?</li>
<li>Are the two actively exploited Windows vulnerabilities patched across affected systems?</li>
<li>Which computers or servers failed to install the update?</li>
<li>Which devices are waiting for a restart before the update is actually complete?</li>
<li>Are domain controllers, Remote Desktop systems, DNS, DHCP, file servers, and other critical infrastructure being prioritized according to their exposure?</li>
<li>Are any Windows computers running versions that are no longer normally supported?</li>
<li>If Windows 10 remains in the environment, are those systems properly enrolled in Extended Security Updates?</li>
<li>Can the IT team or provider produce evidence of the installed build or update rather than simply reporting that a patch job ran?</li>
</ul>

<p>That last question is particularly important.</p>

<p><strong>Patch deployment and patch compliance are not the same thing.</strong></p>

<p>A management platform can issue an installation command successfully while an endpoint later fails installation, remains offline, requires a reboot, lacks disk space, has a damaged update component, or otherwise remains vulnerable.</p>

<p>Good patch management measures the final state of the device.</p>

<h2>Windows 10 deserves special attention</h2>

<p>Windows 10 reached the end of normal support on October 14, 2025. Organizations that still require Windows 10 can use Microsoft’s Extended Security Updates program on eligible systems, but those devices must be properly licensed and enrolled to continue receiving applicable critical and important security updates.</p>

<p>Microsoft released an updated Windows 10 ESU Licensing Preparation Package, KB5126256, in September 2026. Installing that preparation package alone does not enroll a computer in ESU. Organizations should therefore verify actual ESU enrollment rather than assuming that seeing the package installed means the system is protected.</p>

<p>This creates an important inventory question for organizations still operating Windows 10: Are those computers intentionally remaining on Windows 10 under ESU, or have they simply been left behind?</p>

<p>Those are two very different risk positions.</p>

<h2>September's updates also contain useful reliability fixes</h2>

<p>The September Windows 11 updates are not solely security patches.</p>

<p>For Windows 11 versions 24H2 and 25H2, Microsoft’s KB5124008 also resolves several issues associated with earlier updates, including problems that could cause Microsoft Teams and the new Outlook to fail or close unexpectedly on certain ARM-based computers. Microsoft also reports fixes for some desktop background and mouse-personalization problems introduced by previous updates.</p>

<p>Windows 11 version 23H2 receives KB5122880, while other supported Windows branches have their corresponding September cumulative updates.</p>

<p>This is another reason organizations should avoid treating patching as a binary choice between “install immediately everywhere” and “wait several weeks.” A better approach is controlled deployment: test on representative systems, monitor the first deployment group, then expand rapidly when no blocking issue appears.</p>

<h2>What a competent patching process should look like</h2>

<p>For most organizations, the September release should trigger a few straightforward actions.</p>

<ol>
<li><strong>Confirm asset inventory.</strong> Know which Windows versions are actually running across workstations and servers.</li>
<li><strong>Identify exposure.</strong> Prioritize systems affected by actively exploited vulnerabilities and systems providing critical network or identity services.</li>
<li><strong>Deploy through controlled groups.</strong> Use a small representative pilot population before broad deployment where business continuity requires testing.</li>
<li><strong>Accelerate high-risk remediation.</strong> Actively exploited vulnerabilities should not sit in a routine multiweek patch queue simply because the normal maintenance schedule says so.</li>
<li><strong>Verify the result.</strong> Measure installed updates, expected operating-system builds, reboot status, failures, and remaining vulnerable devices.</li>
<li><strong>Investigate exceptions.</strong> Every unpatched system should eventually have a reason, an owner, and a remediation plan.</li>
</ol>

<p>The objective is not reckless speed. The objective is reducing the time between a meaningful security risk becoming known and the organization being able to demonstrate that the affected exposure has been addressed.</p>

<h2>A patch-compliance percentage can hide the machines that matter most</h2>

<p>An organization might report 98 percent patch compliance and still have significant exposure if the remaining 2 percent includes a domain controller, externally accessible server, executive laptop, or system containing sensitive information.</p>

<p>That is why patch management should increasingly be viewed as a risk-management process rather than a software-maintenance task.</p>

<p>Executives do not need to study hundreds of CVEs each month. They should expect their IT team or technology provider to separate the noise from the issues that materially affect the organization, deploy updates safely, identify exceptions, and provide evidence that remediation succeeded.</p>

<p>The September 2026 Windows updates provide a useful test of that process. With vulnerabilities already being exploited and several potentially serious remote-code-execution issues included in the release, this is a good month to ask not simply, “Are we patching?” but <strong>“Can we prove the systems that matter are patched?”</strong></p>

<p>If that answer is unclear, review the current Windows patch status with your IT team or technology provider and ask specifically for outstanding security updates, failed installations, pending restarts, unsupported operating systems, Windows 10 ESU status, and exceptions affecting critical infrastructure.</p>

Microsoft’s September Windows updates fix actively exploited vulnerabilities. Learn what business leaders should verify about patching and Windows 10 ESU.

September Windows Security Updates: What Businesses Need to Know

Two Windows vulnerabilities are already being exploited. Here is what business leaders should expect from a mature patching and verification process.

September Windows Updates: Is Your Business Actually Patched?

September 2026 Windows Security Updates: What Business Leaders Should Know

Company

How We Help

Industries

<div class="ce-blog">
  <section class="ce-blog-hero">
    <div class="ce-blog-hero-inner">
      <span class="ce-blog-label">Crown Insights</span>
      <h1>Technology Insights for Smarter Business</h1>
      <p>
        Explore practical insights on IT strategy, cybersecurity, managed IT services,
        technology solutions, and the trends shaping modern businesses.
      </p>
    </div>
  </section>
</div>
{{blog_posts}}


Explore practical insights on IT strategy, cybersecurity, managed IT services, and technology solutions from Crown Enterprises.

Technology Insights | Crown Enterprises

Blog

<section class="ransomware-article">

    <p>
        What if making ransom payments after a data breach invites even more trouble?
        Many businesses believe it's the end of the ordeal, but new research suggests otherwise.
        Learn more about it here.
    </p>

    <h2>What Is Ransomware?</h2>

    <p>
        Ransomware, in its simplest form, is a malicious software designed to encrypt data
        and hold it hostage until you pay the ransom. It's an unfortunate byproduct of our
        rapidly expanding reliance on digital infrastructures.
    </p>

    <p>
        Businesses often have to deal with the following consequences after a successful attack:
    </p>

    <ul>
        <li>Loss of trade secrets, employee information, contracts, and other proprietary data</li>
        <li>Reputational damage and erosion of customer trust</li>
        <li>Financial losses from operational downtime and legal penalties</li>
        <li>Data compliance violations</li>
    </ul>

    <h2>The Perils of Capitulation to Cybercriminal Groups</h2>

    <p>
        A ransomware payment may seem like the quickest way to resolve an attack, but it's
        a slippery slope with no guarantees. The general advice from law enforcement and
        cybersecurity specialists is to never engage with the threat actors.
    </p>

    <p>
        When you acquiesce to an attacker's demands, you help fund their future activities
        while they mark your business as an "easy target," and recent data confirms this trend.
        The cybersecurity research group Proofpoint released its "2026 AI-Era Ransomware Report,"
        which surveyed almost 1,000 security professionals across 12 different markets.
    </p>

    <p>
        According to this global study, over half (54%) of organizations that suffered an attack
        resorted to ransom payments to restore their sensitive data. While 56% of these victims
        did end up regaining access, more than a third (37%) received a second extortion demand
        after paying, while another 2% never got their data back. Are you willing to take this gamble?
    </p>

    <h2>Protecting Your Company From Data Extortion</h2>

    <p>
        Instead of waiting for the worst-case scenario, consider taking the following measures.
    </p>

    <h3>Conduct Scheduled Data Backups</h3>

    <p>
        Back up your data frequently and store copies in isolated offline storage and in a secure,
        cloud-based solution. When ransomware strikes, having clean backups allows you to restore
        operations without giving in to extortion demands.
    </p>

    <h3>Invest in Endpoint Protection</h3>

    <p>
        Use advanced endpoint detection and response (EDR) tools that monitor all devices for
        suspicious activity. These systems can flag unusual file changes or block malicious
        downloads before they wreak havoc on your network.
    </p>

    <h3>Enforce Strong Password Policies</h3>

    <p>
        Use complex passwords, enable multi-factor authentication (MFA), and educate your team
        on avoiding credential reuse across platforms.
    </p>

    <h3>Train Your Employees</h3>

    <p>
        Your team is your first line of defense. Conduct cybersecurity awareness training to
        help your staff spot phishing emails, suspicious links, and common social engineering
        tactics used by hackers.
    </p>

    <h3>Have Backup and Recovery Protocols in Place</h3>

    <p>
        Ransomware actors can strike fast, so having a solid incident response plan is
        non-negotiable. Start by identifying critical assets, then establish clear roles
        for your team during an attack. Simulations and practice drills can help uncover
        weaknesses before hackers do.
    </p>

    <h2>Prevent Repeat Ransomware Attacks With Proactive Cybersecurity</h2>

    <p>
        With no guarantee of data recovery from ransom payments, focus on prevention.
        The investment businesses make toward up-to-date cybersecurity measures often
        pays off in the long run.
    </p>

</section>

Paying a ransomware ransom doesn't guarantee data recovery and may lead to repeat extortion. Learn how proactive cybersecurity can protect your business.

Ransomware Attacks: Why Paying the Ransom Can Lead to More Extortion

Ransom Payments Can Trigger Repeat Attacks

<section class="passkeys-article">
    <div class="passkeys-container">

        <p>
            What if logging into your business systems could be both simpler and more secure?
            Learn about Microsoft business passkeys, a modern alternative to passwords.
        </p>

        <h2>What Are Passkeys?</h2>

        <p>
            Passkeys use cryptographic math instead of traditional codes. When you make a passkey,
            your device keeps a private key, and the website keeps a public key. With this setup,
            you only need to use biometrics or device-based authentication to log in. You never type
            a password, and your company's servers don't have to store one.
        </p>

        <p>This modern form of verification brings many worthwhile advantages for businesses, including:</p>

        <ul>
            <li>
                <strong>Phishing resistance:</strong> Hackers generally can't trick employees or
                customers into giving up a passkey on a fake website because it only works on the
                real, matching site.
            </li>

            <li>
                <strong>No password leaks:</strong> Since companies don't need to store database
                passwords anymore, a server hack won't expose customer or employee credentials.
            </li>

            <li>
                <strong>Fewer IT helpdesk costs:</strong> Staff spend much less time handling locked
                accounts and manual password reset requests.
            </li>

            <li>
                <strong>Faster customer checkouts:</strong> Instead of typing long codes, users can
                use biometrics to confirm transactions faster. This helps lower cart abandonment
                rates for online stores and services.
            </li>

            <li>
                <strong>No bad password habits:</strong> Passkey authentication stops your team from
                using weak passwords or reusing the same code across multiple work systems.
            </li>
        </ul>

        <h2>Microsoft Transitions to Passkeys for Entra ID</h2>

        <p>
            Does your company use Entra ID for its operations? Microsoft is making passkeys the
            default authentication experience for its service as part of a move toward
            phishing-resistant security.
        </p>

        <p>
            Starting September 1, 2026, users who rely on Microsoft-managed SMS or voice
            authentication will begin receiving prompts to register passkeys during sign-in.
            Later, on February 1, 2027, the platform will retire its built-in SMS and voice call
            authentication service completely. If your business still prefers these methods,
            consider looking into replacements before this date.
        </p>

        <p>
            Microsoft warns that today's AI-powered environment demands stronger forms of
            authentication, as threat actors are actively using sophisticated technology to
            fine-tune their attacks. The company shares that the click-through rate of AI-assisted
            phishing emails is a staggering 54%, while traditional methods sit at 12%.
        </p>

        <h2>The Rise of Modern Authentication Techniques</h2>

        <p>
            Microsoft business passkeys might not completely deter data breaches, but they
            significantly reduce the risk of phishing because passkeys are tied to a specific
            website and the user's device.
        </p>

        <p>
            Businesses may also consider the following types of phishing-resistant authentication:
        </p>

        <ul>
            <li>
                <strong>FIDO2 security keys:</strong> Thanks to advanced cryptography, you can use
                small physical hardware devices, such as USB tokens or smart cards, to log into
                websites and apps.
            </li>

            <li>
                <strong>Biometric authentication:</strong> Biometric authentication uses
                fingerprints, facial recognition, and iris scans to verify identities and strengthen
                passwordless sign-ins.
            </li>

            <li>
                <strong>Multi-factor authentication (MFA):</strong> MFA creates an extra layer of
                protection, so when one factor becomes compromised, gaining access would still be
                difficult for attackers.
            </li>
        </ul>

        <p>
            Cyberattacks will only grow more complex moving forward, but the transition to Microsoft
            business passkeys can help companies stay ahead. Many online services aside from
            Microsoft Entra ID already support passkeys, and more are adopting this passwordless
            authentication method every year.
        </p>

    </div>
</section>

Microsoft ends support for older OneDrive systems on Windows 10 version 21H2 and earlier. Learn which devices are affected and how to prepare your business.

Technology Insights for Smarter Business

September 2026 Windows Security Updates: What Business Leaders Should Know

Latest Insights

Ransom Payments Can Trigger Repeat Attacks

Microsoft Makes Passkeys the New Business Standard