--- title: The Biggest Patch Tuesday Ever: What 999 Fixes Mean for a Small Firm - Capstone Technologies Group description: Microsoft's September 2026 Patch Tuesday shipped 999 fixes, two already exploited. Where a professional-services firm is actually exposed, and the five things to do first. canonical_url: https://captechgroup.com/resources/blog/biggest-patch-tuesday-ever-what-999-fixes-mean-for-a-small-firm language: en-GB date: 2026-09-17T15:06:15Z notice: This is a machine-friendly version of the page at https://captechgroup.com/resources/blog/biggest-patch-tuesday-ever-what-999-fixes-mean-for-a-small-firm. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 2216 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/resources/blog/biggest-patch-tuesday-ever-what-999-fixes-mean-for-a-small-firm. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. ![Abstract schematic illustration: a red path cuts down through a component on a circuit board and breaches the layer beneath it](https://images.captechgroup.com/threat-intel/f37d56b7fc.jpg) Microsoft shipped 999 security fixes on September's Patch Tuesday, the most it has ever released in a single day, and two of the flaws were already being used in real attacks before the patches existed. Most of the coverage reads like a parts list. Here is what the release means for a professional-services firm with a few dozen Windows machines, a Microsoft 365 tenant, and no dedicated patching team. ## Why this month is different Volume is the obvious part: 974 of the 999 fixes are in Microsoft's own products, and 723 of those are in Windows. Rapid7, which tracks every cycle, says there is no reason to expect a return to the smaller monthly batches of past years. The less obvious part is the shape of the two flaws already being exploited. Both are local privilege escalation bugs, CVE-2026-85880 in a Windows kernel component and CVE-2026-81963 in the Windows Update Stack. Neither lets an attacker in from the internet. Both let an attacker who is already on a machine as an ordinary user become SYSTEM, which is the step that turns one phished mailbox into control of the network. That matters because the way small firms actually get breached is a staff member running something they should not have, or a stolen session, not a movie-style remote exploit. A bug that upgrades a foothold is worth more to an attacker than a flashy one that creates it. Two wrinkles change the to-do list. CVE-2026-85880 has no patch for Windows 11 or Windows Server 2025, so the fix only applies to older builds, and you need an inventory to know which machines those are. Separately, a browser flaw Google patched in Chrome on September 3 was already being exploited, and while Microsoft pushed the fix to Edge on September 2, it has not published an advisory, so nothing in your normal update reports will tell you whether a given Edge install has it. ## Where a small firm is actually exposed Four places, in rough order of how often we see them matter. **Staff laptops and desktops.** This is where the two exploited bugs live. Any machine where a low-privilege foothold is plausible, which is every machine that receives email, is in scope. Terminal servers, jump boxes, and any workstation that runs a remote-management agent go first. **Remote access.** If you publish Remote Desktop Services or a Remote Desktop Gateway so contractors or remote staff can reach the office, this month's Remote Desktop flaw is rated 9.8 and flagged by Microsoft as exploitation more likely. That single item can justify pulling the patch ahead of your usual schedule. **Exchange, if it is still on your premises.** Four Exchange fixes this month, including a spoofing flaw rated 9.3 and a privilege escalation at 9.1. Mail server compromise typically produces exactly the outcomes your insurer and your regulator ask about: mailbox access, invoice fraud through internal-looking senders, and notification obligations once message content is confirmed exposed. Exchange 2016 and 2019 also lose support on October 14, 2026, with no paid extension offered, as do Office 2021 and Windows Server 2012 and 2012 R2. Anything in those categories stops receiving fixes for problems like these next month. **Identity.** The highest scores in the release are in Microsoft's cloud identity services, including two rated a maximum 10.0, plus a flaw in the Microsoft Authenticator app rated 8.6. The service-side ones are Microsoft's to fix. The Authenticator one sits directly in the multi-factor path most firms rely on, and it is on your phones, not Microsoft's servers. ## The practical takeaway You do not have to patch 999 things this week. You have to make a documented decision about a short list. 1. Push the two exploited privilege-escalation fixes to every machine where someone could plausibly get a foothold, and confirm which machines are old enough to actually receive the first one. 2. If you run Exchange on premises, apply the cumulative update and treat it as the first step of a migration plan, since support ends in October. 3. If you publish Remote Desktop to the internet, patch it now rather than in your next window. 4. Open Edge, go to Settings, then About, and confirm the version by hand against the release notes. The update reports will not show this one. 5. Update Authenticator on staff phones. Where a machine cannot be patched this cycle, remove standard users from the local administrators group and limit which accounts can log on to management hosts. That does not fix the flaw, but it shortens what an attacker can reach after escalating. One more point for the firms that answer to an auditor. HIPAA, PCI DSS, and CMMC obligations commonly define a patch window for critical vulnerabilities, and a release this large makes the triage decision itself the evidence an assessor may ask to see. Write down what you patched first, what you deferred, and why. That record can be worth as much as the patches. The full breakdown, including the CVE-by-CVE sequencing and detection guidance for your IT team, is in our [Threat Intelligence Center write-up](https://captechgroup.com/threat-intelligence-center/september-2026-patch-tuesday-addresses-33-cves-inc-55cab6). If you are not sure which of the four exposure groups above applies to your firm, a [security assessment](https://captechgroup.com/security-assessment) answers that in an afternoon. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-09-17T15:06:15Z", "datePublished": "2026-09-14T12:51:36Z", "description": "Microsoft's September 2026 Patch Tuesday shipped 999 fixes, two already exploited. Where a professional-services firm is actually exposed, and the five things to do first.", "headline": "The Biggest Patch Tuesday Ever: What 999 Fixes Mean for a Small Firm", "image": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/resources\/blog\/biggest-patch-tuesday-ever-what-999-fixes-mean-for-a-small-firm" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/resources\/blog\/biggest-patch-tuesday-ever-what-999-fixes-mean-for-a-small-firm" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "45504-1583", "streetAddress": "2071 N Bechtle Ave, Box 143", "addressCountry": "US" } ] } ```