Install this month's Windows updates, and ask about four more risks this week

Week of 7 to 13 September 2026

Patch Tuesday landed on 8 September, and through the week four more items joined it. Windows needs this month's updates on every machine. If an IT provider looks after your computers, two of the remote-support and management tools they might use, N-able N-central and ConnectWise ScreenConnect, need urgent fixes. If you sell online through Magento, criminals are already exploiting a flaw in it. And if your network runs on MikroTik-brand routers or firewalls, a flaw chain being actively exploited over the internet needs an urgent update. Each item below says who it affects and the one thing to do: a plain question you can email, where the fix is not yours to install.

1. 1

   Install this month's Windows updates on every computer8 Sept

   Every business running Windows, which in Australia is most of them. Windows 10, Windows 11 and Windows Server are all covered. Macs and Chromebooks are not affected by these two.

   Microsoft's September updates fix two flaws that criminals are already using. Neither lets an attacker in on its own: both need a foothold on the machine first (a dodgy download, a phishing attachment, an account someone already has). What they do is turn that small foothold into full control of the computer, which is the step that turns one bad click into a bad week. One flaw is in the Windows Update system itself, the other in a component Windows uses to talk to itself. Both fixes ship in the ordinary monthly update.

   Do this

   Check that this month's Windows updates have installed and the machines have restarted (Settings, then Windows Update, on each computer). If a device manager or IT provider handles updates for you, ask them: "Have the September 2026 Windows updates gone out to every machine, and how many are still pending a restart?"

   Essential Eight: Patch operating systemsISM: System patching

   Sources: Microsoft Security Response Center: CVE-2026-81963 ↗ · Microsoft Security Response Center: CVE-2026-85880 ↗ · CISA KEV: Windows Update Stack link following ↗CVE-2026-81963 · CVE-2026-85880 · CWE-59 · CWE-284 · CWE-122 · CWE-908

2. 2

   Own a MikroTik router or firewall? It needs an urgent update10 Sept

   Businesses with a MikroTik-brand router or firewall. Check the device or ask whoever set up your network. MikroTik says most default setups aren't exposed; the real risk is a device with SSH (remote login) or web admin open to the internet. If your network runs Cisco, Fortinet, Ubiquiti, TP-Link or another brand, skip this one.

   MikroTik makes budget-friendly routers and firewalls used by many small offices, sometimes set up by an IT provider. Researchers found a chain of flaws (nicknamed "MikroTrick") that let an attacker take full control of one of these devices over the internet without a password, if its remote administration access is left open. MikroTik released a fix on 3 September, and within days Poland's national cyber security team confirmed criminals were already exploiting it, with well over 100,000 internet-facing devices still unpatched. Two flaws in that chain were added to the United States' official list of actively exploited vulnerabilities on 10 September.

   Do this

   Ask whoever manages your network equipment: "Do we have any MikroTik routers or firewalls, and if so, are they updated to RouterOS 7.24.2 (or 6.49.21 on the older long-term branch), and is remote administration closed off from the internet?"

   Essential Eight: Patch applicationsISM: System patching

   Sources: CISA KEV: MikroTik RouterOS argument delimiter flaw ↗ · CISA KEV: MikroTik RouterOS missing authentication flaw ↗ · MikroTik: September 2026 security advisory ↗CVE-2026-86060 · CVE-2026-67277 · CWE-88 · CWE-306

3. 3

   Someone else manages your computers? Ask them about N-central this week8 Sept

   Businesses whose computers are looked after by an IT provider or managed service provider. You will not run N-central yourself. They do. If your IT is handled in-house and you have never heard of N-central, this one is not yours.

   N-able N-central is remote monitoring and management (RMM) software, the kind of tool an IT provider uses to reach into every client's computers to patch, fix and monitor them. A critical flaw lets an attacker run their own code on the N-central server without needing a password first. N-able published the fix on 6 September and says it has no confirmation of exploitation in the wild, but the United States cyber agency added it to its actively-exploited list on 8 September. The reason this matters to a small business is simple: whoever controls that server can reach every computer it manages, including yours.

   Do this

   Email your IT provider one question: "Do you run N-able N-central, and if so have you upgraded to 2026.3 Hotfix 4?" A provider who has done it will answer in a sentence. A provider who cannot answer quickly is the answer.

   Essential Eight: Patch applicationsISM: Managed services and outsourcing

   Sources: N-able: N-central 2026.3 Hotfix 4 security update ↗ · CISA KEV: N-able N-central static code injection ↗CVE-2026-86218 · CWE-96

4. 4

   Does your IT support connect to your computer remotely? Ask about ScreenConnect this week11 Sept

   Businesses whose IT provider uses ConnectWise ScreenConnect for remote support. You won't run this software yourself, they do. If your provider uses a different remote-support tool, or nobody has ever remoted into your computer to fix something, this one is not yours.

   ConnectWise ScreenConnect is remote-support software, the tool many IT providers use to see and control your screen when they fix something without visiting in person. A flaw in the ScreenConnect client lets file transfers and program launches happen during an active remote session without the normal on-screen prompt asking you to approve them first. ConnectWise released the fix on 8 September and rated it a high priority, and the United States cyber agency added it to its actively-exploited list on 11 September with a three-day deadline for government agencies to act. Cloud-hosted ScreenConnect accounts updated automatically; only self-hosted installations need a manual upgrade.

   Do this

   Email your IT provider: "Do you use ConnectWise ScreenConnect for remote support, and if it's self-hosted, has it been upgraded to version 26.6.5?" Cloud-based providers update automatically, so they only need to confirm their host clients have been reinstalled since the patch.

   Essential Eight: Patch applicationsISM: Managed services and outsourcing

   Sources: ConnectWise: 2026-09-08 ScreenConnect security bulletin ↗ · CISA KEV: ConnectWise ScreenConnect improper privilege management ↗CVE-2026-84869 · CWE-269 · CWE-862

5. 5

   Sell online through Magento? Patch it now, otherwise skip this one9 Sept

   Businesses running an online shop built on Adobe Commerce or Magento Open Source. If your website is WordPress, Shopify, Squarespace, Wix or anything else, this one does not apply to you.

   The Australian Signals Directorate issued a critical alert on 9 September about Adobe Commerce and Magento Open Source, the software behind many online shops. A flaw lets an attacker run their own code on the shop's server without logging in, and ASD says it is aware of reports that criminals are already doing it. Adobe released the patch on 7 September. The flaw is only reachable if the shop's /graphql address is exposed to the internet, which it is on a normal installation.

   Do this

   If you run the shop yourself, apply Adobe's September patch today. If an agency or developer built and hosts it, ask them: "Is our Magento patched for CVE-2026-75650, and has anyone checked the site for signs it was already exploited?" The second half matters, because the patch closes the door but does not undo a break-in that already happened.

   Essential Eight: Patch applicationsISM: Web application security

   Sources: ASD's ACSC critical alert: Adobe Commerce and Magento ↗ · Adobe security bulletin APSB26-146 ↗ · CISA KEV: Adobe Commerce and Magento template engine ↗CVE-2026-75650 · CWE-1336

Latest ISM release: ISM September 2026: What Changed and What to Check →What the ISM is and how we assess it →