Microsoft addresses critical vulnerabilities in September 8 Patch Tuesday update

Microsoft released its September 8 Patch Tuesday with two local elevation‑of‑privilege flaws that attackers were already exploiting, and both were rated “Important” rather than “Critical.” The vulnerabilities let a low‑privilege user or process gain SYSTEM rights on Windows machines. Microsoft’s advisory urged immediate installation, warning that the bugs could let malware take full control of an infected host.

Patch Tuesday is the monthly cadence where Microsoft bundles security updates for its operating systems and applications. Historically, the company’s severity labels—Critical, Important, Moderate, Low—have guided administrators on which patches to prioritize. In this case, the two flaws, CVE‑2024‑21874 and CVE‑2024‑21875, affect the Windows kernel and the Win32k subsystem. Both were known to be weaponised in the wild before the bulletin, highlighting a gap between Microsoft’s rating and real‑world risk. Security experts have long argued that exploit activity, not just technical impact, should influence severity scores.

The CVE‑2024‑21874 bug allows an attacker with limited access to execute arbitrary code in kernel mode, while CVE‑2024‑21875 bypasses security checks in the graphics driver stack to elevate privileges. Together, they give a foothold that can be used to install ransomware, steal data, or move laterally across a network. Researchers from the cybersecurity community confirmed active exploitation in the wild, citing recent ransomware campaigns that leveraged these flaws. Microsoft’s patches address the code paths directly, and the updates are being rolled out through Windows Update, WSUS, and Microsoft Endpoint Manager.

Security teams are now racing to deploy the fixes before attackers can expand their foothold. Experts advise testing the patches in a controlled environment, then applying them across all Windows 10, Windows 11, and supported server versions within 24 hours. Microsoft says it will review its severity‑rating methodology to better reflect active exploitation trends. For organizations, the episode underscores that “Important” does not mean “low priority” when threat actors are already using the vulnerability. Prompt patching remains the most effective defense.