The number that scared everyone in September
Microsoft’s September 2026 patch release covered 966 individual vulnerabilities across Windows, Office, SQL Server, Exchange, SharePoint, and a handful of other products. A number like that gets screenshotted and passed around IT forums like a fire alarm, and it prompts the obvious question: is this the month to panic? The honest answer is no, but you do need to be paying attention to the right things.
A vulnerability count is not a threat level. It’s more like a list of every crack in a building’s foundation. Some of those cracks are cosmetic. A few of them matter a lot. The job is knowing which ones to fix first.
What “exploited in the wild” actually means
Microsoft tags each CVE with information about whether it’s been actively exploited. That distinction is the one that should drive your patching schedule. Out of hundreds of vulnerabilities in a typical monthly release, usually only a small handful carry that tag. In September 2026 it was two, CVE-2026-81963 and CVE-2026-85880, both local privilege escalation bugs that hand an attacker SYSTEM on a machine they already have a foothold on. The actively exploited list is the one to work from. Those are the ones attackers are already using against real targets, right now, in production environments.
The rest of the list is still worth patching, but not at 11 PM on Patch Tuesday. A SQL Server vulnerability rated “critical” but with no known exploit code in the wild is a different risk than a Windows kernel flaw that ransomware groups are actively weaponizing. Treating them the same wastes time and creates unnecessary disruption.
Where small businesses actually get hit
The patches that cause real damage when they’re skipped tend to cluster around a few areas. Exchange Server is one. If you’re running Exchange on-premises, those nine Exchange Server vulnerabilities aren’t theoretical. Exchange has been a consistent target for years. SharePoint is another one. And anything touching remote access, whether that’s VPN clients, RDP, or remote desktop gateways, tends to be high priority.
Office vulnerabilities are interesting. There were 111 in the September 2026 release. Most of them require a user to open a malicious file, which means your phishing training and email filtering are doing real work alongside patching. You can’t patch your way out of someone clicking a bad attachment, so those controls have to work together.
How to actually prioritize patches without a full IT department
If you’re managing this yourself or with a small internal team, the practical approach is to sort by two things: exploited in the wild first, then CVSS score for anything above 8.0. Microsoft’s own Security Update Guide lets you filter this way. It’s not glamorous, but it works.
For Microsoft 365 environments, Windows Update for Business and Intune give you ring-based deployment. You push critical patches to a small test group first, watch for a few days, then roll out broadly. That process catches the patches that break things before they break things for everyone. A single bad update can take down a line-of-business application for a whole office. A proper ring setup catches it on two machines instead of forty.
If you’re fully cloud-based on Microsoft 365 with no on-premises servers, your exposure is narrower. Windows endpoint patching still matters, but you’re not carrying the Exchange and SharePoint on-prem risk that a lot of mid-size NJ firms still are.
What to do after this month’s release
Check whether your endpoints are current on the September 2026 cumulative update. If you have on-premises Exchange or SharePoint, prioritize those patches. We walked through the same exercise for the August 2026 release. Pull a compliance report from Intune or whatever patch management tool you’re using and look for machines that are more than 30 days behind. Those are your actual risk surface.
Don’t let a big vulnerability number push you into emergency mode every month. Build a repeatable process and stick to it. Patch the actively exploited stuff fast, everything else on a documented schedule, and keep records in case you ever need to show an auditor or a cyber insurance carrier that you’re on top of it.
If you’re not sure where your patch posture stands, Exine works with small and mid-size businesses across New Jersey through managed IT and cybersecurity to get that picture clear and keep it that way.
