September Patch Tuesday: Nine Critical Microsoft Fixes

Microsoft released its September 2026 security updates today, patching nine Critical vulnerabilities across Azure, Microsoft Office and Dynamics 365. This month’s release is lighter than August’s – which fixed more than 400 flaws including three zero-days – but nine Critical-rated patches always warrant prompt attention, and this month is no exception.

What is Patch Tuesday?

Patch Tuesday is the name for Microsoft’s monthly security release, which always falls on the second Tuesday of the month. It is the most predictable item in the IT security calendar, and for any business running Windows, Microsoft 365 or other Microsoft services, it is the moment when new fixes become available for the software your team uses every day.

What has been patched this month?

All nine of September’s vulnerabilities carry Microsoft’s Critical severity rating. The affected product areas are:

• Microsoft Office – vulnerabilities here are particularly significant because Office documents are one of the most common ways attackers deliver malicious code. A booby-trapped Word document or Excel file, opened by a member of staff, can be enough to give an attacker a foothold. Patching Office promptly is one of the most important routine actions any business can take.
• Microsoft Azure – relevant to businesses running workloads in Azure, including virtual machines, Azure Active Directory and Azure-integrated applications. If your business uses cloud-hosted services on Microsoft’s platform, this is in scope for you.
• Microsoft Dynamics 365 – if your business uses Dynamics for CRM, ERP or finance management, ensure your Dynamics environment is updated via the Power Platform admin centre.

None of this month’s vulnerabilities were publicly known before the patches were released, and none are currently being exploited in active attacks. That said, waiting is not a sensible option.

Why Critical still demands action even without zero-days

Microsoft’s Critical rating means, in plain terms, that an attacker could potentially exploit the flaw to run malicious code on your systems – in some cases without any deliberate action from a user. The patch is the only fix.

Once Microsoft publishes security updates, security researchers and cybercriminals alike examine the changes to work out exactly what was repaired. Working exploits can appear within days of a patch release – sometimes hours. The gap between “patch released” and “actively exploited in the wild” has narrowed sharply in recent years. Acting promptly on Critical patches is simply sound risk management.

What this means for your business

If your business uses Microsoft 365, any version of Office, Azure or Dynamics 365 – and most UK SMBs use at least one of these – you are in scope for this month’s update. The good news is that applying the patches is straightforward. The risk lies in not doing it.

What we have done for managed clients

If your IT is managed by System Force IT, your patch management is already in hand. We deploy Critical and Important Microsoft updates to managed endpoints and servers within our standard patching windows, monitor for any issues post-deployment, and maintain an audit log of what was applied and when. You do not need to do anything. We will contact you if any patch requires a scheduled restart or planned downtime.

Reliable, consistent patch management – with full reporting – is a core component of our managed IT support service and our IT support and maintenance packages.

What to do if you manage your own updates

• Windows PCs and servers: open Windows Update (Settings > Windows Update) and install all available updates. Do not postpone Critical updates.
• Microsoft 365 / Office applications: updates usually apply automatically in the background, but you can trigger them manually via File > Account > Update Options > Update Now in any Office application.
• Azure workloads: log in to the Azure portal and review any update or advisory notifications for your deployed services and resources.
• Dynamics 365: check the Power Platform admin centre for any pending environment updates and apply them promptly.

If you are not confident that your systems are being patched reliably each month, that uncertainty is worth addressing. Unpatched Critical vulnerabilities are among the most common entry points attackers use against small and medium-sized businesses. Our IT security services include vulnerability scanning and patch compliance monitoring, so you always have a clear picture of where you stand.

If you would like to talk through what proactive patch management looks like for your business – or have a broader conversation about IT support and planning – get in touch or call 01452 701355 for a no-obligation chat. You can also contact us online here.