Microsoft Patches: Too Little, Too Late?

Microsoft's latest Patch Tuesday, released on September 8, 2026, addressed two significant vulnerabilities that attackers were already actively exploiting. These local elevation-of-privilege flaws allowed low-privilege attackers to gain SYSTEM privileges. Notably, the average time for exploitation now precedes patch releases by an estimated seven days, a trend exacerbated by AI accelerating vulnerability discovery and exploit development. This compressed timeline challenges traditional monthly patching cadences.

Security experts advocate for a dual approach: maintaining scheduled maintenance while continuously assessing exposure and authorizing out-of-schedule actions. This risk-based patching model prioritizes vulnerabilities based on factors like asset reachability, exploitation status, and potential impact. Government agencies and city CISOs are adopting this approach, moving away from a reflex to patch everything towards prioritizing critical vulnerabilities that pose the greatest immediate risk to their environments.

This shift is also reflected in updated guidance, such as CISA's Binding Operational Directive 26-04, which replaces fixed remediation deadlines with a risk-based matrix. The focus is increasingly on how effectively an organization can manage and reduce exposure, especially with exploited-in-the-wild flaws on reachable assets. Board reporting is also evolving to reflect this reality, moving beyond simple ticket closure metrics to showcase progress in shrinking exposure gaps, particularly as AI continues to shorten exploit windows.