Office 2016 and 2019 still get near-monthly Microsoft patches a year after support ended
Microsoft has shipped security updates almost monthly for Office 2016 and 2019 since their end of support, Help Net Security reported. The forecast's author argues the old suites are probably not tested against Microsoft's other updates, so the compatibility risk sits with the teams still running them.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence45
buildOne report1 publisher Two exploited Windows privilege escalations should go first in September's record Patch Tuesday
Microsoft's record September release fixed up to 997 CVEs, including two local escalations to SYSTEM that attackers used before the patch shipped. A 7.8 score understates the step that turns a phishing foothold into control of the machine, so both go ahead of the 9.8 remote flaws.
Reality
- Evidence48
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence42
A record count that Microsoft's own AI bug-hunting produced arrives with two flaws already under attack, and the affected-product lists an operator would use to scope them are the part of the record two vendors read differently.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence58
buildConfirmed2 publishers CVE-2026-81963 in the Update Stack and CVE-2026-85880 in ALPC each take a low-privilege foothold to SYSTEM, and the remediation guidance asks for verified restarts, which is a harder number to report than install counts.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence58
Proofpoint says at least four China-linked espionage groups fired the same BlueMoon code at different victims during the four weeks a Chromium fix took to reach stable Chrome, and two more groups probably did too.
Perspective Coverage
9 publishers
- Builder
- Builder 31%
- Operator
- Operator 60%
- Investor
- Investor 9%
Reality
- Evidence80
- Adoption30
- Hype gap+10
- Incentives40
- Confidence76
Volexity attributes September 1 spear-phishing at multiple NGOs to the Chinese cluster UTA0560. The chain used two Chrome flaws and one in Windows ALPC, and a second China-nexus actor ran the same chain.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence62
Volexity dates UTA0565's exploitation to September 3 and 4, five to six days before it first reported the chain publicly, delivered from typosquats of China Digital Times and the Center for American Progress and ending in a new implant it calls CLEANGULP.
Reality
- Evidence72
- Adoption58
- Hype gap+8
- Incentives52
- Confidence64
buildOne report1 publisher ZoomEye's fingerprint for Cisco's exploited FMC bypass returned zero hosts
A single September 2026 KEV batch produced 1,262,273 GitLab matches and nothing at all for Cisco Secure Firewall Management Center, because the console holding one of the two 10.0 bugs is the one passive scanning cannot fingerprint.
Reality
- Evidence45
- Adoption55
- Hype gap+10
- Incentives70
- Confidence50
buildConfirmed2 publishers Microsoft's September release addressed 972 CVEs, the largest count it has ever shipped. Within hours a researcher published a working proof-of-concept against CVE-2026-69414, the second fix for a Defender flaw first patched in July.
Reality
- Evidence48
- Adoption45
- Hype gap+22
- Incentives55
- Confidence52
Espionage crews exploited a Chrome flaw that Chromium had already fixed in public source
Proofpoint says a shared toolkit called BlueMoon chained two V8 flaws that Chromium had fixed in public but Chrome had not yet shipped, plus a Windows kernel bug that elevates only on older builds.
Reality
- Evidence62
- Adoption58
- Hype gap+18
- Incentives66
- Confidence58
Four espionage crews picked up the same Chrome and Windows exploit chain within days
Proofpoint says two of the three bugs in the BlueMoon chain were fixed in public Chromium source before they reached stable Chrome. Defenders could close one link: an old Windows build.
Publishers:proofpoint.com
Reality
- Evidence62
- Adoption50
- Hype gap+12
- Incentives66
- Confidence58
buildOne report1 publisher Two Chinese actors hit Chrome with byte-identical shellcode before the Chromium fix shipped
Volexity says UTA0560 and JungleBamboo ran the same V8-to-kernel chain against separate targets on September 1, from separate infrastructure and with the same shellcode, while the V8 fix sat in Chromium source.
Publishers:volexity.com
Reality
- Evidence62
- Adoption58
- Hype gap+10
- Incentives60
- Confidence64
Microsoft fixed 974 flaws in September and two were already under attack, but both need an attacker who is already on the machine, while the twenty bugs Dustin Childs classes as wormable need no login at all.
Reality
- Evidence74
- Adoption58
- Hype gap+14
- Incentives60
- Confidence71
CISA has added StyleSmuggler, CVE-2026-75650, to its exploited-vulnerability catalog with a September 11 federal due date. Sansec dates the first exploitation to September 4, which makes the patch and the compromise check one job.
Reality
- Evidence74
- Adoption68
- Hype gap+5
- Incentives32
- Confidence72
Microsoft's record 964-CVE Patch Tuesday includes two exploited zero-days
Tenable's tally for September 2026 is the largest Patch Tuesday on record. It shipped with two bugs already exploited in the wild. The other 962 sit on the calendar as a scheduling problem, and the severity ratings do not sort them by urgency.
Reality
- Evidence55
- Adoption25
- Hype gap+20
- Incentives60
- Confidence50