Two Weeks to the Windows 10 ESU Cliff Edge

Week of 28 September 2026 | Compiled by Team Paringa

Patch volume, ageing Windows 10 fleets and an AI monetisation gap are converging on MSPs at exactly the same moment — and the calendar isn't being generous about it.

What Happened This Week

🔴 September Patch Tuesday: near-1,000 flaws, two actively exploited zero-days

Microsoft's 8 September 2026 Patch Tuesday was, by several outlets' counts, its largest ever security release. Microsoft's own tally is 974 CVEs (rising to 999 once 25 third-party/Chromium-based CVEs are included); BleepingComputer counted 966, Tenable 964, and The Hacker News cited the 974/999 figures directly from Microsoft — the spread reflects different counting methodologies rather than a factual dispute, but it's worth flagging that no two outlets report an identical number. Over 100 vulnerabilities across all counts were rated Critical.

The two headline items are both actively exploited zero-days, both granting SYSTEM-level privileges:

- CVE-2026-81963 (CVSS 7.8) — a link-following flaw in the Windows Update Stack allowing local privilege escalation to SYSTEM. Credited to researcher Romain Deperne and Microsoft's own Threat Intelligence Center. Security researchers noted this is the first Windows Update Stack EoP exploited as a zero-day since 2022. - CVE-2026-85880 (CVSS 7.8) — a heap-based buffer overflow in Windows ALPC (Advanced Local Procedure Call), also enabling SYSTEM-level privilege escalation. Reported by Volexity and Proofpoint researchers. It's the first ALPC vulnerability in a Patch Tuesday release since April 2023.

Microsoft confirmed active exploitation of both but, per its usual practice, disclosed no detail on attacker identity, scale, or which sectors were targeted. Also worth a client-facing flag: CVE-2026-69730 (Windows DNS Server RCE, CVSS 9.8) and CVE-2026-69525 (Remote Desktop Services RCE, CVSS 9.8) were both rated "Exploitation More Likely" by Microsoft's own assessment, even though neither is confirmed exploited yet.

Sources: BleepingComputer | Tenable | The Hacker News

Two privilege-escalation zero-days in the same release, both requiring only local access to reach SYSTEM, is a patching-cadence problem before it's anything else — any MSP client whose patch window still runs on a monthly or "when convenient" cycle needs both CVEs treated as this-week, not this-month. The bigger operational tell is the record CVE count itself: several outlets note Microsoft is now using AI-assisted vulnerability discovery internally, which means CVE volume is likely to keep climbing rather than settle back down. MSPs still triaging patches manually should be planning now for a world where 900+ CVEs a month is the new baseline, not the outlier.

🟡 Windows 10 ESU Year 1 closes 13 October — and the pricing cliff is real

Windows 10 reached end of support on 14 October 2025, and Microsoft's commercial Extended Security Updates programme charges per device, per year, doubling each year: confirmed directly from Microsoft's own documentation as $61 (Year 1), $122 (Year 2), and $244 (Year 3), for a three-year cumulative maximum of $427 per device. ESU must be purchased in full-year blocks — there's no partial-period option — and coverage is cumulative, meaning any organisation that hasn't enrolled by the Year 1 close on 13 October 2026 will be billed retroactively for the year it missed, pushing the minimum entry cost from $61 to $183 per device overnight.

Separately, Microsoft's consumer ESU programme (free via PC Settings sync, 1,000 Rewards points, or a one-time $30 payment) now runs through 12 October 2027 — Microsoft extended it by email in July 2026, acknowledging that "moving to a new PC can take time," a tacit admission that Windows 11 hardware requirements have left a meaningful share of otherwise-functional PCs behind. Windows 11 adoption sits around 70% of Windows devices and has, per The Register's reporting, "mostly stalled in recent months" — meaning a substantial minority of both consumer and business fleets are heading into winter still unpatched-by-default without an ESU decision made.

Sources: Microsoft Learn | The Register

This is the single most concrete, dated action item an MSP can put in front of a client this quarter: run the device count, confirm ESU enrolment status per machine, and get it locked in before 13 October — after that date the cost of inaction roughly triples for anyone still undecided. For clients treating ESU as a way to defer a hardware refresh indefinitely, the escalating $61→$122→$244 structure is Microsoft's own designed disincentive against exactly that; it's worth modelling the three-year ESU total against a phased Windows 11 refresh cost in the same conversation, because past Year 2 the economics usually tip toward replacement.

What MSP Owners Are Dealing With

Kaseya's 2026 State of the MSP Report (covered independently by ITPro) surfaces a monetisation gap that most MSP owners will recognise from their own books: 48% of clients now name AI and automation as their top IT need for 2026 — ahead of cybersecurity and backup — yet only 13% of MSPs are generating meaningful revenue from AI services, even though 53% are already using AI internally to automate ticketing, patching and monitoring. Traditional deal sizes are compressing fast: only 41% of MSPs now report typical annual accounts above $25,000, down from 75% a year earlier, and a third of new clients are "switchers" leaving an existing provider rather than net-new business. Cybersecurity and BCDR remain the reliable growth lines (71% and 50% of MSPs respectively reporting year-over-year growth), which is likely why so many providers are bundling AIOps and patch-automation capability into security-managed services rather than trying to sell it as a standalone AI line item.

Three Things Worth Watching Next Week

1. Windows 10 ESU Year 1 close on 13 October — the single hardest deadline on the calendar this quarter; expect a scramble of last-minute enrolments and a wave of "we missed it" client calls immediately after.

2. Patch behaviour on CVE-2026-69730 and CVE-2026-69525 — both rated "Exploitation More Likely" by Microsoft but not yet confirmed exploited; a shift to confirmed active exploitation would immediately escalate patch priority for any client running exposed DNS or RDS infrastructure.

3. Windows 11 26H2's October 2026 rollout — Microsoft has confirmed the release for fall 2026; watch for early compatibility and deployment issues, since MSPs pushing fleet-wide enablement packages at the same time as the ESU deadline creates a genuine scheduling collision.

Could not verify: Exact Microsoft CVE counts for September Patch Tuesday differ across otherwise-reliable outlets (964 / 966 / 973 / 974, with 999 including third-party CVEs) — treated here as a methodology discrepancy rather than a factual dispute, and Microsoft's own 974/999 figures are used as the primary reference. A CISA KEV catalog page for 21 September 2026 could not be fetched (403 error) and its contents are not reflected in this brief.

Questions? hello@paringa.ai

Paringa works with MSPs and internal IT teams to turn patch cadence, EOL deadlines and fleet-refresh economics into a defensible, board-ready plan rather than a reactive scramble. | 28 September 2026 | © Paringa Ltd