IT Daily Roundup – September 26, 2026
1. Microsoft September 2026 Patch Tuesday: Record 974 Patches, 2 Actively Exploited Zero-Days
Microsoft released a record-breaking 974 security patches as part of September 2026 Patch Tuesday — exceeding 999 CVEs when including third-party products — which represents a historic record and roughly triple the typical monthly volume, reportedly driven by Microsoft's newly deployed AI-powered vulnerability discovery system. Of the patched vulnerabilities, more than 110 are rated Critical and two are being actively exploited in the wild. CVE-2026-85880 (CVSS 7.8) is a heap buffer overflow in the Windows ALPC subsystem that allows local privilege escalation to SYSTEM level without user interaction. CVE-2026-81963 (CVSS 7.8) is a symbolic link resolution flaw in the Windows Update Stack with the same outcome. Patches cover Windows, Office, Exchange Server, SharePoint, Remote Desktop Services, DNS Server, DHCP Server, SQL Server, and Azure.
Why it matters: For any SMB running Windows — which is essentially every company — September 2026 Patch Tuesday is unusually urgent. Both actively exploited zero-days are privilege escalation vulnerabilities: if an attacker has gained any foothold in the system (e.g., via phishing or another exploited piece of software), CVE-2026-85880 or CVE-2026-81963 lets them immediately obtain full admin control over the machine with no further user interaction required. CISA set a September 22 remediation deadline for federal agencies — a strong urgency signal for the private sector. Check Windows Update on all company computers, servers, and VMs today. If IT management is handled by an external provider, explicitly ask when September Patch Tuesday will be deployed.
2. Abandoned CDN Domain Re-Registered — Thousands of Websites Still Calling Infrastructure They Don't Control
Researchers highlighted a widely overlooked supply chain risk in a The Hacker News report: a CDN domain abandoned by its original operator was re-registered by an unknown party who thereby gained wildcard DNS control — meaning control over every subdomain under that domain. Thousands of websites across the internet still contain hard-coded references to hostnames under this domain in their source code. JavaScript, CSS, or other assets loaded from such a domain run in the browser with the full privileges of the hosting page's code: they have access to the DOM, form fields, cookies, and local storage. An attacker controlling the CDN domain can silently steal login credentials, payment form contents, or the entire page DOM — without ever compromising the web server itself. This attack vector is the same one behind numerous historical Magecart attacks on e-commerce sites.
Why it matters: For SMB companies running their own website, online store, or company portal, this is an incident category that standard security tools won't catch: the server is clean, antivirus reports nothing, and yet attackers can be stealing customer data. We recommend auditing the website's source code to inventory all external domains from which JavaScript and CSS files are loaded — particularly old, obscure, or "forgotten" CDN services. For companies running e-shops or forms collecting sensitive data, deploying a Content Security Policy (CSP) in report-only mode is a straightforward solution that catches unauthorized third-party script loading without disrupting normal website operations.
3. SAP OVERPASS — Critical SAP Kernel Vulnerability Enables Unauthenticated Remote Code Execution
Onapsis researchers uncovered and BleepingComputer reported a critical vulnerability, CVE-2026-44756 (dubbed OVERPASS), in SAP Kernel code — specifically in the Extended Passport Protocol (EPP) parsing library within the Internet Communication Manager (ICM). A classic buffer overflow in the EPP parsing library allows an unauthenticated attacker with network access to the ICM interface (which, for an internet-exposed SAP system, describes its normal operating configuration) to remotely execute arbitrary commands with SAP administrative privileges. The result is full compromise of SAP processes and all business data including financials, payroll, and operations. According to Onapsis, more than 10,000 SAP systems are directly exposed to the internet and therefore directly at risk. SAP released a patch as part of its regular September 2026 security update cycle.
← All postsWhy it matters: SAP ERP systems manage corporate finance, inventory, HR, and entire business operations — they are literally the heart of a mid-sized company. A critical unauthenticated remote code execution vulnerability in the ICM module is a worst-case scenario: an attacker can reach financial statements, payroll data, business contracts, and the entire ERP system directly from the internet with no valid credentials whatsoever. For companies running SAP Business One, S/4HANA, or NetWeaver, applying September's patches should be treated as an immediate priority. If your SAP systems are managed by an external partner, request written confirmation of when the patch was or will be applied.