Microsoft just shipped the largest Patch Tuesday in its history - 974 CVE fixes in a single release, with two privilege-escalation zero-days already exploited before the patches landed. That alone would dominate any patch cycle. But September 9 also brings a CVSS 10.0 unauthenticated RCE in SAP’s kernel, a CISA KEV deadline on Friday for a repeatedly-broken RMM tool, and a fileless rootkit hiding inside F5 BIG-IP appliances. Defenders have a full plate today.

In the News

Microsoft Patches Record 974 CVEs With Two Exploited Zero-Days

Microsoft’s September 2026 Patch Tuesday fixes 974 vulnerabilities - doubling the company’s 2020 annual total with three months still remaining in the calendar year. Of the 974 fixes, 113 carry a critical severity rating. Microsoft credits AI-assisted vulnerability discovery for the accelerated disclosure volume, a trend that has been building since the company integrated LLM-based code analysis into its Security Development Lifecycle earlier this year.

Two zero-days are confirmed exploited in the wild. CVE-2026-81963 is a privilege-escalation flaw in the Windows Update Stack that chains link-following with improper access control (CVSS 7.8). CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) that also achieves local privilege escalation (CVSS 7.8). Both map to MITRE ATT&CK T1068 - Exploitation for Privilege Escalation.

The operational challenge is not the two zero-days - those get prioritized immediately. The challenge is triaging the remaining 972 fixes. Organizations running monthly patch cycles face a testing backlog that no manual process can absorb at this volume. Risk-based vulnerability prioritization that correlates CVSS with exploit availability, asset criticality, and network reachability is the only approach that scales.

What defenders should do: Prioritize CVE-2026-81963 and CVE-2026-85880 for immediate deployment. For the remaining 113 critical-severity fixes, use exploit-correlated prioritization to identify which are reachable in your environment. Validate that endpoint detection rules for privilege-escalation techniques (Sysmon Event ID 1 process creation, Event ID 10 process access) are current.

SAP OVERPASS Kernel Flaw Enables Unauthenticated RCE at CVSS 10

CVE-2026-44756 - dubbed “OVERPASS” - is a memory corruption vulnerability in SAP Extended Passport Processing, the kernel-level component responsible for request tracing across SAP application landscapes. The flaw requires no authentication and enables full remote code execution over standard SAP service ports. SAP shipped the fix on September 8 alongside 19 other security notes.

The severity here is straightforward: CVSS 10.0, unauthenticated, remotely exploitable, and targeting a component present in virtually every SAP deployment. SAP kernel patches require system restarts and testing against custom ABAP code - a process that routinely takes weeks in enterprise environments. During that gap, the network perimeter is the primary compensating control.

What defenders should do: Deploy intrusion prevention signatures targeting the OVERPASS exploit pattern on any firewall between untrusted networks and SAP service ports. Validate that SAP systems are not directly internet-exposed. Begin SAP kernel patch testing immediately - the window between public disclosure and exploitation attempts for CVSS 10.0 SAP flaws has historically been measured in days, not weeks.

N-able N-central RCE Hits KEV - CISA Deadline Is Friday

CVE-2026-86218 (CVSS 10.0) is a pre-authentication remote code execution flaw in N-able’s N-central remote monitoring and management platform. CISA added it to the Known Exploited Vulnerabilities catalog on September 9 with a remediation deadline of September 11 for federal agencies - a two-day window that reflects how urgent the exploitation timeline is.

This is the fifth N-central critical hotfix in five weeks. That cadence is not normal patching; it is a pattern indicating systemic code-quality or architecture issues in a tool that holds privileged agent-level access to every endpoint it manages. RMM platforms are among the highest-value targets in the supply-chain attack hierarchy - a single compromised N-central instance gives an attacker code execution on thousands of managed endpoints.

What defenders should do: Patch N-central immediately. If patching cannot be completed by Friday, segment RMM traffic to approved management VLANs only and enforce phishing-resistant MFA on all N-central administrative access. Monitor for anomalous process execution originating from N-central agent processes. Evaluate whether the five-in-five-weeks pattern warrants a longer-term RMM platform risk assessment.

F5 BIG-IP APM Rootkit Hides Web Shell in Memory

A Linux rootkit targeting F5 BIG-IP Application Policy Manager devices uses a technique that intercepts Apache’s PHP module loading process and injects a web shell directly into memory - the payload never touches disk. Sophos published analysis on September 7 confirming active exploitation. This maps to MITRE ATT&CK T1014 - Rootkit and T1505.003 - Server Software Component: Web Shell.

Traditional endpoint detection does not cover network appliances. BIG-IP devices run embedded Linux without standard EDR agent support. File-integrity monitoring - the go-to control for web shell detection - is entirely bypassed when the payload exists only in memory. The detection path runs through network traffic analysis: anomalous outbound connections from BIG-IP management interfaces, unexpected DNS resolution patterns, and HTTP response sizes inconsistent with legitimate application behavior.

What defenders should do: Treat BIG-IP APM deployments as assumed-compromise and validate integrity using F5’s iHealth diagnostic tool. Monitor BIG-IP management interface traffic for anomalous outbound connections. Review Apache process memory for injected PHP handlers. Consider whether on-premises VPN/ADC appliances should be migrated to cloud-delivered zero-trust network access models that eliminate the appliance attack surface.

Defender Action Items

  • Patch CVE-2026-81963 and CVE-2026-85880 immediately - both are exploited Windows privilege-escalation zero-days
  • Deploy IPS virtual patching for CVE-2026-44756 (SAP OVERPASS) on firewalls protecting SAP service ports; begin SAP kernel patch testing
  • Patch N-able N-central CVE-2026-86218 before the September 11 CISA deadline; segment RMM traffic and enforce MFA on administrative access
  • Validate F5 BIG-IP APM integrity using iHealth; monitor management interfaces for anomalous outbound traffic
  • Update Chrome to version 153 to address CVE-2026-87491 (seventh V8 zero-day of 2026)

Detection Queries

The following Splunk SPL query identifies potential privilege-escalation activity associated with the Windows Update Stack zero-day (CVE-2026-81963). It looks for unusual child processes spawned by the Windows Update orchestrator:

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
ParentImage="*\\musNotification.exe" OR ParentImage="*\\UsoClient.exe" OR ParentImage="*\\WaaSMedicAgent.exe"
NOT (Image="*\\TiWorker.exe" OR Image="*\\WudfHost.exe" OR Image="*\\svchost.exe")
| stats count by host, Image, ParentImage, User, CommandLine
| where count < 3
| sort -count

This query baselines normal Windows Update Stack child processes and flags anomalous process spawning - a high-fidelity indicator for T1068 exploitation targeting the Update Stack. Expect a low false-positive rate in environments where Windows Update orchestration is well-understood. Tune the NOT clause for any custom update tooling in your environment.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.