Patch Tuesday, September 2026: Microsoft's Largest Release on Record, and a Flaw at the Bottom of the SAP Stack

This September Patch Tuesday brings 974 items, a number from one vendor I did not expect to write this year. That is the CVE count in Microsoft's release notes for September 8, and it is the largest single release the technology giant has ever shipped. SAP's Patch Day the same morning produced 19 new security notes and one update. Four of the new notes are HotNews, and one of them reaches the kernel that S/4HANA, ECC and NetWeaver run on.

Microsoft: 974 Fixes, Two Already Exploited, Two More Rated Likely

Two flaws were exploited before anyone outside Microsoft knew they existed. CVE-2026-85880 is a heap overflow in Windows ALPC, the inter-process messaging layer beneath every version of Windows. Microsoft's advisory describes an attacker escaping an AppContainer sandbox and taking SYSTEM with no user interaction. CVE-2026-81963 is a link-following flaw in the Windows Update Stack, the components that install updates, and reaches the same outcome. Both carry CVSS 7.8 and Microsoft rates them Important rather than Critical. In a release this size that puts them behind roughly a hundred higher-scored flaws, none of which are known to be under attack. If you prioritise by severity rating alone, you will patch these two last when they should go first. CISA added both to the KEV catalog on release day.

Behind them is a second tier worth reading. CVE-2026-69525 is a use-after-free in Remote Desktop Services scored 9.8 that Microsoft rates "Exploitation More Likely," with three further RDS remote code execution flaws beside it. CVE-2026-69730 is a 9.8 in Windows DNS Server that an unauthenticated attacker can reach with a crafted packet. The release also carries fresh Servicing Stack Updates for Windows Server 2012, 2012 R2 and 2016.

SAP: 19 New Notes, and a Kernel Flaw That Fires Before Login

CVE-2026-44756, Note 3747649, scores 10.0 and is the reason to read this section. Onapsis Research Labs found it and named it OVERPASS. It is a memory corruption flaw in Extended Passport processing, a tracing feature inside the SAP kernel, and what makes it unusual is where it fires. Onapsis explains that EPP is processed as a session opens, so every control SAP has for deciding who may do what is evaluated after the point the flaw is reached. They describe three routes in, over web requests, SAP GUI and RFC, none requiring credentials, with the resulting code running as the account that owns the SAP installation. The vulnerable kernel ships in S/4HANA, ECC, NetWeaver, BW/4HANA, PI/PO, Solution Manager and Web Dispatcher 9.16. Note here that no exploitation has been reported thus far.

CVE-2026-58240, Note 3759472, CVSS 9.8, lets an unauthenticated attacker register a rogue component with the NetWeaver Message Server. It affects the whole modern kernel family, which means every S/4HANA 2025 system.

Two items follow up on August. SAP updated Note 3771065, last month's 10.0 in Commerce Cloud, to state that unmodified environments are not exposed by default. And MII, which took two HotNews notes in August, gets Note 3786489, a request forgery flaw with no automatic correction and nine manual hardening steps.

How this affects MedTech

In a medical device manufacturers environment, SAP arguably holds lot for example, in terms of traceability, supplier qualification and often complaint intake. OVERPASS lives beneath all of it. A flaw that executes as the SAP service account before authentication is not a question of what an attacker could read. It is a question of whether anything the system recorded afterwards can be relied on, which is the claim 21 CFR 11.10 asks you to stand behind for electronic records, and one that the QMSR, through ISO 13485 clause 4.1.6, asks you to stand behind for the software itself.

The Windows side matters for two reasons, and they are different. Remote Desktop Services is how a field service engineer reaches device workstations, so a 9.8 remote code execution flaw in that service, rated more likely than not to be exploited, is a flaw in the front door to the systems that touch devices. The two zero-days work the other way round. They are privilege escalations, which means an attacker uses them after phishing an engineer, to turn that engineer's ordinary user account into SYSTEM. On a service laptop, SYSTEM is the saved credentials, VPN profiles and service tools that reach devices in the field.

Quick recommendations this week

Start with Windows first, because exploitation is confirmed. Deploy the September cumulative update on service laptops, engineering workstations and any validated system that can take it, and treat September 22 as your own deadline. CISA's current directive, BOD 26-04, also expects agencies to check whether a system was compromised before the patch went on. That is worth checking for anything internet-facing, look before you close the ticket. Where a validated system cannot be patched in the window, write down the compensating control, the owner and the residual risk in your risk register with a concrete remediation timeline.

For SAP, apply Note 3747649 to every ABAP and Java kernel and to Web Dispatcher 9.16, and do not rely on segmentation to buy time, since Onapsis assesses that no single network control mitigates it. Note 3759472 goes next. Then work the nine MII steps by hand.

Finally, re-read Note 3771065. SAP now says an unmodified Commerce Cloud deployment is not exposed by default and has published an FAQ to verify your configuration. If your August ticket for that flaw is still open, running SAP's check and recording the result may be enough to close it.

Key Takeaway

Microsoft's number will dominate the headlines this month, and it should not dominate your week. Two Windows flaws already in use and one SAP flaw that runs before the login screen are the whole story. Everything else is a prioritisation exercise your existing process should handle.

Sources and Further Reading

Primary: MSRC release notes, September 2026 · CISA KEV additions, September 8, 2026 · SAP Security Notes, September 2026 · SAP Notes 3747649, 3759472, 3786489

Coverage: Onapsis · Tenable · Zero Day Initiative · SecurityWeek · The Record