Patch Tuesday: September 2026 (Expel’s version)

**Executive summary:** Microsoft’s September Patch Tuesday is a record release (964 CVEs) that includes two Windows privilege‑escalation zero‑days exploited in the wild and added to CISA’s KEV catalog; separately, Adobe Commerce/Magento suffered an unauthenticated CVSS 10.0 RCE (StyleSmuggler, CVE-2026-75650) that was actively exploited before a hotfix, with evidence of persistent implants on compromised stores—patch immediately and treat potentially reachable stores during the exploitation window as incidents requiring full forensic response.