Patch Tuesday September 2026

Zero-Days and Critical SAP Flaws: Patch Tuesday September 2026

IT administrators face urgent patch requirements this September: alongside two active zero-day vulnerabilities in Microsoft systems, a maximum-severity threat in SAP poses significant infrastructure risk. Here is a breakdown of the most critical vendor updates.

Microsoft: Active Zero-Days in Focus Microsoft addresses key security vulnerabilities across Windows 10, Windows 11, and all major Server editions this month. System administrators should prioritize two particularly high-risk flaws:

• Zero-Day Vulnerabilities: The two active zero-days (CVE-2026-81963 and CVE-2026-85880) require immediate remediation.
• Widespread Fixes: A comprehensive breakdown of all affected systems and deployment details is available here.

SAP & Infrastructure: Maximum Severity for EPP Vendor activity extends beyond Redmond: SAP released four critical updates, headlined by a memory corruption flaw in the processing of SAP Extended Passport (EPP) rated at a maximum CVSS 10/10. Further details on this and other vulnerabilities can be found here.

Additionally, several key vendors provided essential security patches:

• Crowdstrike: FalconFlank, a suspected zero-day vulnerability in the CrowdStrike Falcon Sensor for Windows, allows local privilege escalation.
• HPE: Patch addressing a critical RCE vulnerability in ArubaOS-CX.
• Adobe & Cisco: Security updates across multiple product lines to safeguard network integrity.

Background: What Is Patch Tuesday?

Patch Tuesday is the established industry standard for distributing security updates. On the second Tuesday of every month, Microsoft releases a consolidated batch of patches across its software portfolio. This predictable schedule enables system administrators and users to streamline update cycles and systematically secure their infrastructure against known threats.