Photo by James McKinven on Unsplash
The name says it all, really. Zero-day. Zero days of warning. Zero days to prepare before attackers were already using it.
Microsoft confirmed this month that two serious Windows vulnerabilities -- CVE-2026-85880 and CVE-2026-81963 -- were being actively exploited before the September security update was even released. The fixes are out now, but the window when systems were exposed and attackers were active has already passed. That is the uncomfortable fact sitting behind this month's patch release.
What a zero-day actually means for your business
A zero-day vulnerability is a security flaw in software that exists before the vendor knows about it, or before a fix is available. When Microsoft says both of these vulnerabilities were "exploited in the wild" before the patch landed, they are confirming that real attackers used them against real targets -- not in a testing environment, but out in the open.
Microsoft has not yet disclosed who was responsible or how attackers were initially getting in. That is not unusual when active exploitation is confirmed early -- releasing too much detail too quickly gives other attackers a working blueprint. But it does mean there are still unanswered questions about what to look for beyond applying the update itself.
Why small businesses are not off the radar
A common assumption is that sophisticated attacks only go after big organisations with something obviously worth stealing. That is not how most of this works in practice.
Many attackers operate opportunistically. They scan the internet for unpatched systems rather than picking specific targets in advance. If your Windows devices are unpatched and reachable, that is the selection criterion -- not your company's size or sector.
UK small businesses are also increasingly valuable because they sit within supply chains of larger organisations, they hold customer data and payment information, and they often have less formal patch processes in place than enterprise IT teams. All of that adds up to a target that is easier to reach and harder to detect activity within.
What to do right now
The immediate action is straightforward: apply September's Windows security updates if you have not already done so. That means checking every device -- laptops, desktops, and any Windows servers your business runs on. Do not assume automatic updates have run. Confirm it.
If you are genuinely not sure whether your systems are up to date, that uncertainty is itself worth solving. Automated patch management removes the guesswork by applying updates on a structured schedule and giving you a clear record of what has been patched across your estate and when.
Once patching is confirmed, the next question is harder but more important: would you have had any visibility if an attacker used one of these flaws before September's update was available? For most small businesses, the honest answer is probably not. Knowing what is running on your network and whether anything unusual happened is not a luxury -- it is the foundation of being able to respond rather than just discover a breach after the fact. Vulnerability management gives you that structured view, and regular vulnerability scanning and reporting helps you understand where your weaknesses are before attackers find them.
This is part of a pattern that is not slowing down
Two zero-days confirmed exploited in a single month is not exceptional. Earlier this year, a single Microsoft update addressed close to a thousand individual vulnerabilities. The pace of both patching and exploitation has been increasing steadily, and the gap between a vulnerability being discovered and attackers using it in the real world is shrinking.
The practical implication for small businesses is that checking for updates when someone remembers to -- or hoping your IT provider has it covered without verifying -- is not a workable approach anymore. For two vulnerabilities this month, the exploitation was already happening before the patch existed. That is the reality of the current environment.
The practical takeaway
Apply September's Windows updates now if you have not already. Then ask yourself one question: if something had accessed your systems during the period when these vulnerabilities were live, would you know about it? If the answer is no, or you are not sure, that is the more important problem to address -- and it is a solvable one.