Office 2016 and 2019 still get near-monthly Microsoft patches a year after support ended
Microsoft has shipped security updates almost monthly for Office 2016 and 2019 since their end of support, Help Net Security reported. The forecast's author argues the old suites are probably not tested against Microsoft's other updates, so the compatibility risk sits with the teams still running them.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence45
buildOne report1 publisher Two exploited Windows privilege escalations should go first in September's record Patch Tuesday
Microsoft's record September release fixed up to 997 CVEs, including two local escalations to SYSTEM that attackers used before the patch shipped. A 7.8 score understates the step that turns a phishing foothold into control of the machine, so both go ahead of the 9.8 remote flaws.
Reality
- Evidence48
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence42
A record count that Microsoft's own AI bug-hunting produced arrives with two flaws already under attack, and the affected-product lists an operator would use to scope them are the part of the record two vendors read differently.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence58
buildConfirmed2 publishers CVE-2026-81963 in the Update Stack and CVE-2026-85880 in ALPC each take a low-privilege foothold to SYSTEM, and the remediation guidance asks for verified restarts, which is a harder number to report than install counts.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence58
buildOne report1 publisher ZoomEye's fingerprint for Cisco's exploited FMC bypass returned zero hosts
A single September 2026 KEV batch produced 1,262,273 GitLab matches and nothing at all for Cisco Secure Firewall Management Center, because the console holding one of the two 10.0 bugs is the one passive scanning cannot fingerprint.
Reality
- Evidence45
- Adoption55
- Hype gap+10
- Incentives70
- Confidence50
buildConfirmed2 publishers Microsoft's September release addressed 972 CVEs, the largest count it has ever shipped. Within hours a researcher published a working proof-of-concept against CVE-2026-69414, the second fix for a Defender flaw first patched in July.
Reality
- Evidence48
- Adoption45
- Hype gap+22
- Incentives55
- Confidence52
Microsoft fixed 974 flaws in September and two were already under attack, but both need an attacker who is already on the machine, while the twenty bugs Dustin Childs classes as wormable need no login at all.
Reality
- Evidence74
- Adoption58
- Hype gap+14
- Incentives60
- Confidence71
CISA has added StyleSmuggler, CVE-2026-75650, to its exploited-vulnerability catalog with a September 11 federal due date. Sansec dates the first exploitation to September 4, which makes the patch and the compromise check one job.
Reality
- Evidence74
- Adoption68
- Hype gap+5
- Incentives32
- Confidence72
Microsoft's record 964-CVE Patch Tuesday includes two exploited zero-days
Tenable's tally for September 2026 is the largest Patch Tuesday on record. It shipped with two bugs already exploited in the wild. The other 962 sit on the calendar as a scheduling problem, and the severity ratings do not sort them by urgency.
Reality
- Evidence55
- Adoption25
- Hype gap+20
- Incentives60
- Confidence50