A 966-Fix Patch Tuesday, Two Live Zero-Days and a Compromised RMM: Four Weeks to the October Cut-Off

Week of 14 September 2026 | Compiled by Team Paringa

The largest Patch Tuesday Microsoft has ever shipped landed in the same week the MSP industry's own management tools were being exploited. Both stories point at the same gap: fleets that cannot be patched quickly, by tooling that cannot be trusted blindly, with a hard October deadline approaching.

What Happened This Week

🔴 Record 966-vulnerability Patch Tuesday includes two exploited privilege-escalation zero-days

Microsoft's September 2026 Patch Tuesday, released on 8 September, addressed 966 vulnerabilities, the largest single release in the company's history and well above the previous records of 570 in July and 400 in August. 105 are rated Critical: 81 remote code execution, 20 elevation of privilege, 2 information disclosure and 1 security feature bypass. Counts vary by vendor between 964 and 974 depending on methodology, but every tracker agrees on the two that matter most.

Both actively exploited zero-days give a local attacker SYSTEM. CVE-2026-81963 is a link-following flaw in the Windows Update Stack, the component that installs Windows updates, which means the mechanism used to deliver the fix is itself the target. CVE-2026-85880 is a heap buffer overflow in Windows Advanced Local Procedure Call (ALPC). Neither needs remote access; they are the second stage after a phishing click or a compromised remote-management session, which makes them the standard toolkit for ransomware operators moving from one user's desktop to domain-wide control.

The Critical list reaches beyond the desktop. Copilot Studio (CVE-2026-80098) and Entra ID (CVE-2026-83941) both carry Critical elevation-of-privilege fixes, and GitHub Copilot and Visual Studio Code have information-disclosure patches. The same week, Google patched an exploited Chrome V8 zero-day, SonicWall fixed two chained SMA1000 zero-days, and CrowdStrike advised customers to disable a Windows policy setting after a researcher published a Falcon privilege-escalation exploit.

The timing is the real pressure. Windows 11 24H2 Home and Pro reach end of servicing on 13 October 2026, as does mainstream support for Windows Server 2022 (extended security-only support runs to October 2031). Windows 11 26H2 is in the Release Preview channel as a 174 KB enablement package (KB5121794, build 26300.9278) with general availability expected in October. That gives IT teams four weeks to deploy the largest patch set on record, validate 26H2, and move any 24H2 estate before it stops receiving fixes like these.

Sources: BleepingComputer, SecurityWeek, The Register

Two numbers decide whether this month is routine or a breach: days-to-patch on the two zero-days, and the percentage of the fleet still on 24H2 on 13 October. Most mid-market estates we see run 30 to 45 days on non-emergency patching and have no reliable count of which build each device is on. Both of these fixes should be forced within 72 hours, with a ring of pilot devices on 26H2 by the end of September so the October move is a single reboot rather than a project. If the answer to "what is our 24H2 count" takes longer than an hour, that is the finding, and it is the reason managed deployment exists.

🟡 N-able N-central hit by weekend zero-day as ScreenConnect rogue installs surface

N-able alerted customers over the Labor Day weekend (5 to 7 September) to a critical zero-day and two further vulnerabilities in N-central, its remote monitoring and management platform used by more than 500,000 IT teams and MSPs. Hotfixes for two CVEs identified by Rapid7 Labs and Huntress went out on the Saturday, followed by a third patch on the Sunday after an undisclosed party found a flaw that "could allow pre-authenticated access to the N-central server." This follows two urgent N-central fixes in early August; Huntress said its new exploit was directly related to those original vulnerabilities, meaning the August patch did not close the class of bug.

The consequence of a compromised RMM console is total: Huntress' analysis shows an attacker with N-central access can run scripts, push tools and open remote sessions across every managed endpoint. In the same fortnight Huntress detected anomalous rogue ScreenConnect installations on the ConnectWise platform, and ConnectWise issued a 4 September advisory promising a fix within a week. Huntress' Michael Tigges summarised the pattern: RMMs are becoming a common attack vector, especially in the SMB segment. On-premises N-central customers were told to upgrade immediately, review logs for scanning activity and audit user accounts; hosted customers were patched automatically but advised to run the same checks.

Sources: Channel Dive, Huntress

If your IT provider manages your fleet through N-central or ScreenConnect, ask three questions this week: which version are they on, when was it patched, and have they audited the accounts on the console since 5 September. A reputable MSP answers all three within the hour. The wider lesson is that the management platform is now a Tier 0 asset, the same as the domain controller, and needs MFA, IP allow-listing and independent detection rather than trust. Fleet deployment is only as safe as the console that runs it.

🟡 Copilot Business promo ends 30 September as PC memory prices push refresh budgets up

Microsoft's introductory $18 per user per month price for Copilot on Business Standard and Business Premium expires on 30 September, after which it reverts to $21. For enterprise, the $30 per user Copilot add-on now sits on top of base licences that rose on 1 July, taking the all-in cost to roughly $69 per seat on E3 with Teams and $90 on E5. Most organisations have yet to demonstrate a return on the first tranche of seats, and the September date is a decision point for renewals as much as new purchases.

At the same time, the memory market is reshaping PC refresh economics. IDC expects average PC selling prices to rise by up to 8 percent in 2026 as DRAM bit-supply growth of roughly 16 percent falls short of AI and consumer demand, with Samsung, SK Hynix and Micron diverting capacity to high-bandwidth memory. Consumer trackers show 64 GB DDR5 kits at over $1,100. For a Windows 10 ESU estate still waiting on hardware, the replacement device costs more every quarter it is deferred, while the ESU fee itself doubles in year two.

Sources: Windows Latest, IDC

Two budget lines are moving in opposite directions: the Copilot seat you may not need is about to cost more, and the PC you definitely need is already costing more. The rational move is to audit Copilot usage by seat before 30 September and release licences that show no activity, then redirect that money into bringing the hardware refresh forward rather than paying a second year of ESU on machines that will be replaced anyway. A managed refresh with staged deployment lets you buy in tranches against a rising price curve instead of one late, expensive order.

What IT Directors and Heads of IT Operations Are Dealing With

The workload this month is not new in kind, but it is new in scale. A patch set of 966 fixes on top of two live privilege-escalation exploits, a management platform that needed three emergency patches in one weekend, an OS version end-of-life in four weeks and a licence decision on 30 September. None of these can be delegated to a quarterly maintenance window. Each is a same-week action, and most mid-market IT teams are already running at capacity on daily operations.

The underlying shift is that the tools the industry relies on to manage fleets at scale, RMM platforms, update stacks, identity services, are themselves the targets. Fleet management now needs the same controls as any other critical system: patched on a measurable cadence, monitored independently, and operated by people whose job is that and only that. That is the case for managed deployment and ongoing support, not as an outsourcing decision but as a security control.

Three Things Worth Watching Next Week

1. Exploitation reports on CVE-2026-81963 and CVE-2026-85880 - Expect CISA KEV additions and public proof-of-concept code within days. Any device unpatched by 20 September should be treated as exposed.

2. ConnectWise ScreenConnect fix and N-central post-incident detail - ConnectWise promised an official fix within a week of 4 September. Watch for the root-cause statement and whether the N-central August patch is formally reissued.

3. Windows 11 26H2 general availability and the 24H2 deadline - GA is expected in early-to-mid October, just before 13 October. Organisations without a tested 26H2 ring by 30 September will be upgrading and patching in the same window.

Questions? hello@paringa.ai

Paringa delivers managed fleet deployment and ongoing end-user support with TruOffice, so patching, OS upgrades and device refresh run on a measured cadence rather than an emergency one. Infrastructure and AI security, cost and governance, from the datacentre to the desktop. | 14 September 2026 | © Paringa Ltd