Patch Tuesday September 2026: Adobe Commerce CVSS 10, two Windows zero-days, and an N-central nightmare for MSPs

A heap-based buffer overflow in Windows ALPC (the local inter-process communication mechanism) lets an attacker who already has a foothold on the box escalate to SYSTEM. This is exploited in the wild right now. The attacker needs local access or code execution first, but once they have it, privilege escalation is trivial.

Affected estate

Windows sysadmins running Windows 10 1607, 1809, or 21H2 (x86, x64, or ARM64)

How to check

Run 'winver' or query 'Get-ComputerInfo | Select OsBuildNumber' to confirm the OS build. Cross-reference with your patch management console for missing cumulative updates.

Included because

exploited in the wild; local privilege escalation; common OS; CVSS 7.8

Action

Deploy the latest cumulative update for the affected Windows 10 builds immediately.

Why it matters

Attackers are already using this to escalate from a standard user to SYSTEM on compromised hosts.

Source

Microsoft Security Update Guide

An attacker with local access can abuse a symlink (link-following) bug in the Windows Update Stack to escalate privileges. This is exploited in the wild. Because it targets the update mechanism itself, a compromised system could potentially interfere with future patching if left unaddressed.

Affected estate

Windows sysadmins running Windows 11 23H2, 24H2, or 25H2 (x64 or ARM64)

How to check

Run 'winver' or check 'Get-HotFix | Sort InstalledOn -Descending | Select -First 5' to see if the latest cumulative update is installed.

Included because

exploited in the wild; local privilege escalation; targets update mechanism; common OS

Action

Deploy the latest Windows 11 cumulative update immediately.

Why it matters

Attackers are exploiting this now, and because the bug lives in the update stack, a compromised machine may resist future patches.

Source

Microsoft Security Update Guide

N-able N-central has a static code injection bug that lets an unauthenticated attacker get remote code execution, no login required. This is exploited in the wild. If you're an MSP running N-central, this is the kind of bug that gives attackers the keys to every endpoint you manage.

Affected estate

MSPs and IT teams running N-able N-central on-prem or hosted instances

How to check

Log into the N-central admin console and check Administration > Product Version, or query the N-central API for the running version.

Included because

unauthenticated; pre-auth RCE; exploited in the wild; RMM tool with broad downstream access

Action

Upgrade N-central to the patched version listed in N-able's advisory.

Why it matters

Pre-auth RCE on your RMM platform means an attacker can pivot to every managed endpoint in your client base.

Source

N-able Security Advisory

Adobe Commerce has a template injection bug that lets an attacker execute arbitrary code without any user interaction, and with a scope change (meaning the attacker can break out and affect resources beyond the vulnerable component). CVSS 10.0, exploited in the wild. If you run Magento/Adobe Commerce, drop everything and patch this.

Affected estate

Anyone running Adobe Commerce (Magento) 2.4.4 through 2.4.4-p11, or any unpatched Adobe Commerce version

How to check

Run 'bin/magento --version' in your Commerce root, or check the admin panel under System > About. Compare against Adobe's patched version list.

Included because

unauthenticated; internet-facing; CVSS 10.0; exploited in the wild; scope change; no user interaction

Action

Apply the Adobe Commerce security patch or upgrade to the latest patched release immediately.

Why it matters

CVSS 10.0 with scope change, no user interaction needed, and attackers are already hitting this. Compromised storefronts mean stolen payment data and full server control.

Source

Adobe Security Bulletin