Microsoft Fixes Two Exploited Important Vulnerabilities

What changed

Microsoft’s September 8 Patch Tuesday fixed two vulnerabilities that attackers were already exploiting. Both were rated Important, not Critical, and both allowed an attacker running low-privilege code to elevate to SYSTEM privileges.

Why it matters

The practical lesson is uncomfortable: severity labels are not a patch queue. A flaw rated Important can still be the urgent one when attackers are actively using it to take full control of a machine.

For enterprise security teams, that makes exploitation status more useful than the label alone. The two vulnerabilities show how a modest foothold can become SYSTEM-level access, turning an initial compromise into control of the computer. The affected products, scale of exploitation and patch adoption were not specified, so the broader reach is still unclear.