CSIPE

Published

- 21 min read

After a Record Patch Tuesday, Your Windows Update Needs a Receipt

Microsoft Windows Online Safety Software Updates Vulnerabilities

Books by the author

Compare all 5

As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog.

A Windows laptop can spend all week telling you that it is “up to date” while a restart is waiting in the corner. The update has downloaded. Part of it may even have installed. Yet the repair that matters can still be sitting behind a small power-button dot and a request to restart tonight.

That ordinary loose end matters this week. On 8 September 2026, Microsoft released its largest monthly security update so far and said two of the repaired Windows flaws were already being used in real attacks. The two flaws, CVE-2026-81963 and CVE-2026-85880, can help somebody who already has a foothold on a computer gain the powerful SYSTEM level of access. The US Cybersecurity and Infrastructure Security Agency added both to its catalogue of flaws with evidence of active exploitation on the same day (CISA; Qualys).

You do not need to read nearly a thousand vulnerability descriptions. You do not need a paid scanner, and you do not need to decide which news site counted the bundle correctly. Your useful job is smaller: open Windows Update, install the September security update, restart when Windows asks, then return to Windows Update and read the result. The second visit is the receipt.

This is a good week to turn that receipt into a household habit. An update notification shows that Windows has work available. A completed check after the restart shows where the computer actually stands.

What Microsoft fixed on 8 September

The headline number is enormous, although it is less precise than many headlines suggest. Qualys and Krebs on Security counted 974 vulnerabilities in Microsoft’s September 2026 release. Tenable counted 964, while BleepingComputer counted 966. The difference comes from which product entries, republished records, and externally assigned flaws each tally includes. For an ordinary Windows owner, the honest description is “roughly 970 Microsoft flaws,” not a contest over the last ten rows (Krebs on Security; Qualys; Tenable).

The agreement is more important. Every detailed account identifies this as a record release and names the same two Windows vulnerabilities as exploited before the fixes arrived. Qualys counted 113 Critical and 860 Important entries in its 974 total. Tenable used a narrower set and counted 104 Critical plus 860 Important. Those labels help teams sorting many Microsoft products, but neither count tells you that 974 separate strangers can now walk straight into your laptop.

The two exploited flaws are both labelled Important and both involve elevation of privilege. CVE-2026-81963 is a link-following weakness in the Windows Update Stack. CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call, a part of Windows that helps processes communicate on the same machine. Microsoft’s descriptions say an attacker needs local access as an authorised user before either flaw can be used. Successful exploitation can raise that access to SYSTEM, one of the operating system’s most powerful identities (Tenable; Qualys).

That sequence is worth holding onto. These are not described as two new ways for any stranger on the internet to enter every Windows PC directly. They are better understood as ladders inside the house. Somebody or some malicious program first gets a lower level of access, perhaps through another weakness, a harmful download, a stolen sign-in, or a different route. The September flaws can then help that intruder climb from an ordinary room to the cupboard holding the master keys.

CISA’s catalogue removes any doubt about whether the ladders have been used. It added both entries on 8 September and gave US federal civilian agencies a 22 September due date under its own rules. CISA lists ransomware use as unknown for both. That last detail matters because “actively exploited” and “used by ransomware” answer different questions. The public evidence supports prompt updating; it does not support telling every home user that ransomware has already used these exact flaws on their machine.

The rest of the bundle covers a wide range of Microsoft products and failure types. Some entries affect server features that a family laptop may never run. Others affect Office, SQL Server, cloud services, development tools, media components, or specialised Windows roles. Krebs highlighted a serious Windows DNS Server flaw and a Windows Shell flaw among the many repairs, while Tenable’s analysis shows that elevation of privilege made up 44.7 percent of its counted set and remote code execution made up 26.8 percent. This is why a raw count is poor personal risk advice: the haystack is huge, but each computer carries only some of it (Krebs on Security; Tenable).

Windows Update does that matching for a normal supported PC. It checks the Windows version, processor type, installed components, and update history, then offers the cumulative package that applies. You can let the machine do that dull work. The count belongs in the news; the completed installation belongs on your computer.

The two-step attack behind “SYSTEM access”

SYSTEM sounds dramatic because it is powerful. Windows uses accounts and service identities to decide which files, settings, devices, and other processes a program can control. A standard user sits below an administrator, and even an administrator does not perform every action with the operating system’s own identity. SYSTEM is the identity used by core services for work that needs broad authority.

Picture a guest who has already slipped into the hallway but cannot open the locked office. An elevation-of-privilege flaw can be the bad hinge that lets the guest force that inner door. The hinge did not bring them through the front entrance. Once forced, however, it changes what they can reach and how difficult they are to remove.

That distinction explains both the urgency and the calm. A local privilege flaw usually needs a first step, so finding an unpatched computer does not prove that somebody is inside. Yet attackers often combine steps. A harmful attachment or stolen account may provide limited access; the privilege flaw can turn that limited position into control over security settings, other accounts, or parts of the operating system that an ordinary user cannot change.

CVE-2026-81963 sits in the Windows Update Stack, the machinery that helps service Windows. Its “link following” description refers to a familiar computing problem. A program believes it is opening or changing one file, but a link redirects that operation somewhere more sensitive. If a privileged service follows the wrong link without sufficient checks, a lower-privileged user may cause powerful code to act on a location that user could not touch directly.

CVE-2026-85880 sits in Advanced Local Procedure Call. ALPC carries messages between processes on the same Windows computer. The flaw involves memory handling, specifically a heap-based buffer overflow and use of an uninitialised resource according to the public records. You do not need to diagnose memory corruption. The practical shape is enough: code already running locally may misuse the flaw to gain higher privileges.

Both were scored 7.8 out of 10 and rated Important rather than Critical. A score is a structured description of technical conditions and impact, not a queue position for your kitchen table. Evidence that a flaw is already being exploited can make a 7.8 repair more pressing than a higher-scored flaw with no known working attack against the computers you own. CISA’s same-day additions make that prioritisation explicit.

This also explains why antivirus is not a substitute for the update. Security software may recognise a known malicious file or suspicious behaviour used in the first step. It may interrupt part of an attack. The Windows repair removes the particular faulty hinge that lets the second step work. Asking antivirus to compensate forever leaves an avoidable route in place and assumes every future use will look like one it already knows.

A standard user account still helps. If daily work runs without administrator rights, many mistakes begin with less authority. That can reduce damage and create an extra prompt before sensitive changes. The September flaws show the limit: software bugs can sometimes provide a climb. Account separation buys resistance, while current security updates repair known climbs.

For a home computer, the sensible response remains proportionate. Install the cumulative update through Windows Update. Do not download a “zero-day detector” from an advert, run proof-of-concept code from a forum, or wipe a healthy machine merely because it missed Tuesday night. If you find concrete signs of interference, that becomes a different job. Patch status alone cannot prove either compromise or cleanliness.

Downloaded, installed, restarted, verified

Windows update language describes several different states with words that can look reassuring at a glance. “Downloading” means files are arriving. “Installing” means Windows is applying work it can perform while you continue using the machine. “Restart required” means the job has reached a point where running parts of Windows must be replaced during a restart. “You’re up to date” after a fresh check is the state worth keeping.

Imagine a family laptop that stays open for weeks. Windows downloads the September package in the background on Wednesday. Someone notices “Restart required” but closes the lid because a video call begins. The machine sleeps overnight, wakes on Thursday, and continues running the older components. Nothing has failed. The last part simply has not happened.

A shutdown may not always behave like the clean restart people expect. Modern Windows can use Fast Startup, which preserves part of the operating system’s state during shutdown so the next start is quicker. Windows Update knows how to coordinate its own process, and the safest choice when it asks is the explicit Restart now or Update and restart command. That removes the guess about whether closing the lid, pressing the power button, or choosing a normal shutdown completed the servicing step.

Microsoft’s support page for Windows 11 versions 24H2 and 25H2 identifies the 8 September cumulative package as KB5124008, with OS builds 26100.9445 and 26200.9445. Windows 11 version 26H1 uses KB5124012 and OS build 28000.2954. Older supported versions can receive different KB numbers and build numbers, so copying a friend’s number is a poor test (Microsoft Support; Microsoft Support).

This is one reason the receipt should come from your own Windows Update page. After restarting, open Settings, choose Windows Update, and select Check for updates. Let the check finish. If another security or cumulative update appears, install it and complete any further restart. Then open Update history and look for the most recent successful quality or security update dated September 2026.

The KB number is useful when you need to compare your screen with Microsoft’s support page, but you do not need to memorise it. Windows editions and versions follow different servicing lines. A successful September cumulative update on the correct line is better evidence than matching a number copied from an article that may describe a newer or older Windows release.

A progress bar reaching 100 percent is not the same evidence. Installers can roll back after a restart, a laptop can lose power, or Windows can schedule another attempt. Update history records whether the package succeeded. Returning to the main page catches any remaining restart request. Together, those screens turn “I think it updated” into something another family member can check in a minute.

The receipt also keeps fear in its proper place. If Update history says the September cumulative update installed successfully and Windows Update finds nothing else required, you have completed the ordinary response. You do not need to hunt through 974 entries or buy a product that promises to scan the whole list. Keep the machine on its normal supported update path and get back to using it.

Why the record count should not run your evening

A record patch count makes good news copy because it compresses a complicated release into one startling number. It does not measure the chance that your particular laptop will be attacked tonight. The bundle includes products you may not own, features you may not have enabled, and flaws that need conditions absent from your machine. Different researchers can make reasonable counting choices and land ten entries apart.

Krebs reported that Microsoft’s September release took the 2026 total past 2,600 flaws, more than twice the company’s previous annual record from 2020, with three months still to go. The same report quotes security researchers describing AI-assisted discovery as one reason the haystack has grown. Better and faster bug finding can increase the number of published repairs without proving that software became 974 times more dangerous on Tuesday (Krebs on Security).

There is a useful upside hidden inside the frightening total. A vulnerability that receives a repair is a weakness the vendor has named and given users a way to close. A larger release can reflect more detection and more maintenance. It can also create real work for organisations that must test specialist software before changing thousands of computers. Both can be true without turning the count into a personal emergency score.

A hospital, factory, or company with a custom Windows application cannot treat patching exactly like a family laptop. Its administrators may test a small group first, watch for compatibility failures, prepare rollback options, and deploy in stages. They also need an inventory because a successful update on 990 computers says nothing about the ten machines that were switched off. Their difficult problem is safe coverage at scale.

Most home users have the opposite problem. They wait because they imagine that enterprise testing is required in the living room. For a normally supported personal PC using standard applications, Windows Update is the designed delivery route. Krebs makes the same distinction: ordinary users do not need to test the patches before deploying them, but they should open Windows Update and should not let monthly releases accumulate.

That does not mean every update is perfect. A repair can introduce a compatibility fault, and Microsoft documents known issues on its support pages. The practical answer is a small preparation, not indefinite delay. Save current work, make sure irreplaceable files have a backup, plug in a laptop, allow time for a restart, and use the built-in route. If one named application breaks afterwards, troubleshoot that evidence rather than assuming the security update was either flawless or catastrophic.

The count is also a poor reason to install third-party “driver updater” or “PC cleaner” tools. Those products do not become more useful because Patch Tuesday is large. Some add pop-ups, replace drivers Windows already manages, or create a second update channel you must now trust. The September Windows repairs arrive through Windows Update. Go to the front desk, not to somebody waving a copied notice in the car park.

One number does deserve attention: two exploited flaws. It tells you that the repair closes routes attackers have already used somewhere. It does not tell you that your machine was one of those places. Let that number move the update into today’s short task, then let the receipt end the task.

A twenty-minute Windows update check

Choose a point when the computer can be unavailable for a little while. A laptop should be connected to power, and open documents should be saved. If the machine holds the only copy of family photographs, tax records, or current work, copy those files to another device or a reputable cloud account before changing anything. That backup is useful every day, not just on Patch Tuesday.

  1. Open the real Windows Update page. Select Start, open Settings, then choose Windows Update. Do not follow a pop-up in a browser, an email link, or a search advert that claims to provide the September patch. The built-in Settings page is the known front door.

  2. Let Windows check. Select Check for updates and wait for the result. Install the security or cumulative updates offered for the Windows version on that computer. Optional driver and feature previews can wait unless you have a separate reason to install them. The security task does not require pressing every optional button on the page.

  3. Finish the explicit restart. If Windows shows Restart required, save anything still open and choose Restart now or schedule a definite time that you will keep. Closing the lid postpones the work. Choose the update-aware restart command rather than hoping an ordinary shutdown has the same effect.

  4. Return for the receipt. After signing back in, open Settings and Windows Update again. Select Check for updates once more. Confirm that no restart remains pending and that Windows reports the current state after finishing its check.

  5. Read Update history. On the Windows Update page, open Update history. Look under quality or security updates for a successful September 2026 cumulative update. Windows 11 24H2 and 25H2 may show KB5124008; Windows 11 26H1 may show KB5124012. A different supported line can show another package, so use the date and successful status before comparing the exact number with Microsoft’s page.

  6. Check the Windows version if the update never appears. Press the Windows key, type winver, and open the result. Note the edition and version. Compare that version with Microsoft’s Windows lifecycle information or ask a trusted technician whether it is still supported. A machine outside support can honestly say there are no available updates while receiving none of the new repairs.

  7. Test the ordinary things you need. Open the browser, email, printer, work application, and any accessibility tool that matters in your day. A quick test catches a real compatibility problem while you still remember what changed. Do not manufacture a problem by running exploit demonstrations or registry-cleaning tools.

  8. Stop when the receipt is clean. If the September update succeeded, no restart remains, and normal applications work, you are finished. You do not need to read every CVE, reset every password, or reinstall Windows because the monthly count set a record.

A relative helping over the phone can ask for two photographs: the main Windows Update page after the final check and the relevant line in Update history. Those pictures answer more than “Did you update it?” because people quite reasonably call the download, the first installation screen, and the restart all “the update.” The receipt gives both sides the same evidence.

Small businesses should add one piece of paper or a simple spreadsheet. Record each computer’s name, who uses it, the date of the successful September update, and any machine that could not complete the job. A list of five computers needs no special management platform. It does need somebody to notice the laptop that has been in a drawer since August.

There is permission to ignore a few things. You can skip optional preview updates unless they solve a problem you recognise. You can skip dramatic videos ranking all 974 flaws. You can skip any website that asks you to download its own scanning utility before it will tell you whether Windows Update succeeded. Spend your patience on the built-in page, the restart, and the receipt.

When “You’re up to date” is not enough

The phrase depends on the update service knowing what your Windows version is entitled to receive. A fully supported Windows 11 computer that has just checked, restarted, and checked again gives useful evidence. An old release beyond its support period may also find no new package, but for a very different reason. The shop is closed rather than the shopping list being complete.

Microsoft’s September support page says Windows 11 version 24H2 Home and Pro editions reach the end of updates on 13 October 2026. That date is close enough to include in this check. If winver shows Windows 11 24H2 Home or Pro, install September’s update now and allow Windows to move to a supported feature version before the October deadline. Business and specialised editions can follow different dates, so match the edition as well as the version (Microsoft Support).

Windows 10 requires similar care because its support path depends on edition, release, and any applicable extended programme. Do not assume that a familiar Windows 10 desktop receives the same September package as Windows 11. Open winver, read the full result, and use Microsoft’s lifecycle pages or a trusted support person to identify the current route. The right answer may be an available update, an enrolled extended-support path, a supported edition with a later date, or a planned move to a newer system.

Another weak receipt is an update that says Failed to install. Repeatedly pressing the button without reading the error can consume an evening. Start with the simple conditions: connect power, restart once, confirm there is enough free storage, check the date and time, and try Windows Update again. Write down the KB number and error code if it fails a second time. Those two pieces give Microsoft Support or a technician something concrete to investigate.

Managed work computers belong to the employer’s update process. The Windows Update page may say that some settings are controlled by your organisation or may delay a package while the IT team tests it. Do not bypass that policy with a package from an unofficial site. Save your work, leave the computer powered and connected when asked, and report a persistent restart or failure notice to the support desk with a screenshot.

A computer that cannot start after an update needs recovery, not internet guessing from the affected machine. Take a photograph of the error. Use Windows recovery options or contact the person who supports the device. Avoid a hurried clean installation until you know whether irreplaceable files have another copy. Most update trouble is repairable, but improvisation becomes expensive when the only copy of the household archive sits on the same disk.

There is one more edge case: the update succeeds, yet you find evidence of an intrusion. An unfamiliar administrator account, security software switched off without explanation, new remote-control software, repeated sign-ins you do not recognise, or files encrypted and renamed all deserve attention. Installing September’s patch closes the two repaired routes going forward. It cannot tell you whether somebody used a route before the repair or whether a different route remains.

Preserve what you can see, disconnect the computer from the network if unexplained activity is continuing, and use another trusted device to secure important accounts. A technician may need to examine or rebuild the machine. The trigger for that larger response is evidence on the computer or accounts, not the fact that Windows missed one Patch Tuesday restart.

Make the receipt the habit

Monthly updates are easiest when they become boring. Pick a recurring point after the second Tuesday of each month, perhaps Wednesday evening or the first quiet hour at the weekend. Plug in the laptop, save work, open Windows Update, install what is required, restart, then return for the receipt. The whole routine often takes less time than deciding whether to postpone it again.

Automatic updates still help. They download packages and reduce the chance that a computer goes months without repairs. Their weak spot is the human boundary at the end: a laptop sleeping in a bag cannot install or restart on time, and a person can keep dismissing the same prompt. A monthly receipt catches the machine that automatic maintenance could not finish.

Households with several computers can keep the rule plain. Each machine needs one owner, even if that owner is the family member who knows where Settings lives rather than a security expert. The owner keeps files backed up, allows monthly restarts, and asks for help when Update history shows a failure. Nobody needs to monitor security news every morning.

The September release also shows why supported software matters. A vendor can find and repair hundreds of weaknesses, but only machines still on a serviced path receive the work. Replacing or upgrading an unsupported computer is inconvenient and may cost money. Keeping an unsupported system online indefinitely turns every future Patch Tuesday into a list of doors that machine cannot repair.

If replacement cannot happen immediately, reduce what the old machine can reach and what you trust it to do. Move banking, email administration, password management, and sensitive work to a supported device. Keep good backups and avoid exposing remote access. That is a temporary reduction in consequence, not a way to manufacture security updates after the vendor has stopped supplying them.

The Digital Fortress uses the same front-door principle throughout: choose the few locks that protect many parts of your life and make sure you actually turn them. Windows Update is one of those locks because the operating system sits beneath the browser, documents, accounts, and security tools you use each day. The useful action is wonderfully unglamorous.

Microsoft’s 8 September 2026 release is historically large, and the two exploited flaws deserve prompt attention. Neither fact requires panic. Open the built-in update page, complete the restart, and check the history afterwards. If the receipt says success and the computer works, carry on.

You have my blessing to skip the race to memorise 974 flaws. Remember one route instead: Settings, Windows Update, restart, Windows Update again.

For calm, practical security guidance without a daily alarm bell, join the newsletter. It is one email per month.

Sources