Microsoft's September security updates fixed a Windows flaw that attackers were already using in real-world attacks, and the government patch deadline for it passed only yesterday.

• What it is: A heap-based buffer overflow in a core Windows component (CVE-2026-85880) that lets an attacker escalate to full system privileges once inside a device.
• Who is affected: Any Windows 10 or Windows 11 PC, or Windows Server, that has not yet installed the September 2026 security updates.
• What the risk is: The flaw is already being exploited, and CISA added it to its Known Exploited Vulnerabilities list with a 22 September 2026 deadline for US government systems, an early warning sign for everyone else.
• What action is needed: Confirm the September Windows updates have installed and rebooted on every device, including servers.

We recommend checking Windows Update history on your key machines this week if you are not certain the September patches have gone through.