September Patch Tuesday: 81 fixes, two zero-days; Windows 10 ends soon, Windows 11 gains

Microsoft's September Patch Tuesday delivers a heavy dose of security fixes for both Windows 10 and Windows 11 — including two publicly disclosed zero-days — but reserves the most visible user-facing improvements for Windows 11, reinforcing that Windows 10 is now in its final maintenance phase ahead of end of support on October 14, 2025. (support.microsoft.com)

Background: what dropped on Patch Tuesday and why it matters​

Microsoft released cumulative updates for Windows 10 and Windows 11 on September Patch Tuesday: KB5065429 for Windows 10 builds and KB5065426 for Windows 11. These packages bundle security fixes, servicing stack updates, and quality improvements; organizations and home users should expect Windows Update to offer the patches automatically, but administrators often prefer staged deployment and testing first. (support.microsoft.com)
This month’s update includes fixes for 81 distinct vulnerabilities, among them two that have been publicly disclosed and flagged as zero-day or high-priority issues: CVE-2025-55234, an SMB relay/improper-authentication flaw that can enable elevation of privilege in some configurations, and CVE-2024-21907, a denial-of-service issue tied to older versions of the Newtonsoft.Json library used by some Microsoft products (notably certain SQL Server components). Patching is strongly recommended for all affected systems. (cyberscoop.com)
At the same time, Microsoft continues to steer feature development and innovation toward Windows 11 (version 24H2 and Copilot+ PCs), shipping new AI-driven features and interface improvements that will not appear on Windows 10. With Windows 10’s support window closing, the contrast between maintenance-mode Windows 10 updates and feature-forward Windows 11 updates is now stark. (learn.microsoft.com)

---

Overview of the security landscape in this update​

What the two most notable vulnerabilities do​

• CVE-2025-55234 (SMB Server relay / improper authentication): This vulnerability affects the Windows SMB server component and can be exploited in scenarios where SMB hardening (SMB signing and Extended Protection for Authentication) is not properly enforced. Attackers can perform relay-style attacks that may result in elevated privileges. Microsoft’s update adds audit capabilities and guidance to help administrators prepare for and adopt SMB hardening without immediately breaking legacy clients. (cvedetails.com)
• CVE-2024-21907 (Newtonsoft.Json DoS): An older but still relevant flaw in the widely used Newtonsoft.Json library can produce a StackOverflow exception under crafted input and cause a denial of service in affected components (Microsoft patched affected SQL Server builds and other products that bundle vulnerable Newtonsoft.Json versions). This is a reminder that third-party libraries remain a persistent supply-chain vector. (netizen.net)

Multiple independent security trackers and industry write-ups corroborate Microsoft’s characterization of these issues and encourage rapid patching — especially for servers and internet-facing machines where SMB exposure or untrusted input handling is more likely. (softcat.com)

Practical mitigation steps you should take now​

• Install the September cumulative update via Settings > Windows Update (or your chosen update management system) and reboot when prompted. For enterprises, stage the update to a pilot group first.
• For SMB risk reduction, enable SMB Server Signing and Extended Protection for Authentication where feasible, and use Microsoft’s new audit capabilities to identify clients that would be impacted before enforcing hardening. (cvedetails.com)
• For environments using SQL Server or other Microsoft services bundling Newtonsoft.Json, ensure the vendor-supplied patches or updated components are applied; where vendor fixes are pending, consider compensating controls (rate-limiting, input validation, isolation). (netizen.net)

---

Windows 10: penultimate update and the end-of-life context​

The maintenance posture and what “penultimate” means​

This September update is explicitly a maintenance release for Windows 10: security fixes and quality patches only, no new feature rollouts. Microsoft has publicly signaled that Windows 10 is entering its final months of mainstream servicing, with October 14, 2025 set as the end-of-support date. After that date, free updates and standard support end; organizations can opt for Extended Security Updates (ESU) to buy time, while individual consumers must migrate or accept increased risk. (support.microsoft.com)

Options for Windows 10 users after October 14, 2025​

• Upgrade to Windows 11 if the hardware and compatibility checks pass (TPM 2.0, Secure Boot, supported CPU families, and other platform requirements).
• Purchase Extended Security Updates (ESU) as a temporary bridge for environments that cannot migrate immediately; Microsoft has documented consumer ESU pricing previously and businesses should expect rising costs across subsequent years. (theverge.com)
• Migrate to alternate OSes or isolated/air-gapped configurations for legacy workloads where upgrade is impractical.

For many organizations, ESU is a short-term bridge while they plan hardware refreshes or application compatibility remediation; it should not be treated as a permanent strategy.

---

Windows 11: feature update highlights and AI-forward changes​

September’s Windows 11 cumulative (KB5065426) is notable because Microsoft bundled visible feature and UX improvements alongside the security fixes — a reminder that Windows 11 remains Microsoft’s primary innovation vehicle.

Major consumer-facing changes in this release​

• Recall enhancements (Copilot+ PCs): Recall now opens to a personalized home page showing recent activity, frequently used apps, and searchable snapshots. Users can set filters to control what gets captured and use a new navigation bar for Home, Timeline, Feedback, and Settings. The Recall experience remains opt-in by design and enforces Windows Hello for access to stored snapshots. (learn.microsoft.com)
• Click to Do improvements: The Click to Do overlay now launches an interactive tutorial on first use and supports new actions such as handing selected text or images to Microsoft 365 Copilot on Copilot+ devices. Click to Do continues to be primarily local-device processing on Copilot+ hardware. (blogs.windows.com)
• Taskbar and Notification Center refinements: You can enable a larger clock with seconds in the Notification Center (a usability change many power users have requested), and the search UI on the taskbar provides more visual progress and grid image results. File Explorer context menus received small visual refinements to improve clarity. (blogs.windows.com)
• Windows Hello and passkey UX: Windows Hello has a cleaner design and Microsoft says setup and passkey usage are now smoother and more intuitive — part of a broader push toward passwordless authentication. (learn.microsoft.com)
• Settings and activation dialog polish: Activation prompts and other system flows now mirror Windows 11 design language more closely; the Settings app also surfaces which third-party apps have used Windows-provided generative AI models (Text and Image Generation under Privacy & security) and extends the Settings agent functionality to Copilot+ devices across CPU platforms. (learn.microsoft.com)

Multiple official Microsoft Insider blog posts and Learn pages describe these capabilities in detail, and independent tech outlets have summarized the user-visible changes; taken together they demonstrate a continued emphasis on AI, local model processing on Copilot+ hardware, and an incremental UX polish cycle. (blogs.windows.com)

---

Critical analysis: strengths, trade-offs, and risks​

Strengths​

• Security-first while still innovating: Microsoft balanced delivering critical security patches (81 CVEs) with a set of tangible Windows 11 improvements. That combination is valuable: enterprises get mitigation now while consumers see the product direction for the next several years. (cyberscoop.com)
• Local-AI privacy model for Copilot+ features: Recall and Click to Do emphasize local model execution and Windows Hello gating; that reduces cloud exposure and addresses some privacy concerns that surfaced during earlier testing. The opt-in requirement and local-only processing are important design choices. (learn.microsoft.com)
• Granular SMB hardening guidance: Responding to CVE-2025-55234, Microsoft adds audit tooling to help administrators adopt SMB hardening incrementally, which reduces the risk of blanket hardening breaking legacy clients. This is a pragmatic, enterprise-friendly approach. (cvedetails.com)

Trade-offs and potential downsides​

• Feature fragmentation and hardware gating: Many of the headline features (Recall, Click to Do, on-device Copilot experiences) are limited to Copilot+ hardware, which requires modern NPUs or specific silicon platforms. That means users on older but compatible Windows 11 PCs will see a different experience, and Windows 10 users get none of these enhancements. This creates a growing feature gap across the installed base that can be confusing for consumers and complicates support for enterprises.
• Complexity for admins: SMB hardening and audit tooling are necessary but add a layer of operational complexity; organizations will need to map client compatibility, test hardening in pilots, and possibly temporarily preserve legacy authentication flows for older devices until they can be upgraded. (cvedetails.com)
• Residual privacy concerns: Even with local processing, Recall’s behavior — taking snapshots of on-screen activity — remains sensitive. The opt-in approach and Hello-protected access are good controls, but organizations with strict compliance requirements will want to formally evaluate Recall before enabling it broadly. Microsoft’s privacy pages explain controls, but conservative environments may block the feature entirely. (support.microsoft.com)
• Cost and transition burden for Windows 10 holdouts: ESU pricing and the need for hardware upgrades to get the full Windows 11 experience raise real financial and logistical issues. ESU is temporary and increases in cost over time; hardware replacement cycles and driver compatibility headaches will keep enterprise migration projects non-trivial. (theverge.com)

---

Practical checklist: immediate actions for home users and IT teams​

For all users (home and small business)​

• Check Windows Update and install the September cumulative update (KB5065429 for Windows 10, KB5065426 for Windows 11). Reboot after install. (support.microsoft.com)
• Update any third-party apps that embed Newtonsoft.Json or other vulnerable libraries; apply vendor patches for SQL Server if applicable. (netizen.net)
• Back up important files before month-end feature upgrades or big updates; use system image tools or cloud backups for peace of mind.

For enterprise IT teams and security admins​

• Prioritize servers and internet-facing endpoints for immediate patching (SMB-related fixes deserve early attention). Use maintenance windows and rollback plans. (cyberscoop.com)
• Use Microsoft’s SMB audit tooling in the update to identify clients that will break when SMB hardening is enforced; plan a staged rollout. (cvedetails.com)
• Reevaluate patching policies and decide whether to enable or delay Copilot+ features like Recall in managed fleets; update privacy assessments and user consent flows where required. (support.microsoft.com)
• Create a Windows 10 migration roadmap: identify hardware incompatible with Windows 11, calculate ESU costs if long-term migration is impossible, and prioritize refreshes for high-risk or high-value endpoints.

---

Upgrades, compatibility, and workarounds: practical considerations​

• Upgrading to Windows 11 remains the primary Microsoft path for long-term security and feature benefits, but not all devices qualify. Hardware checks remain the gating factor. Enterprises should use Microsoft’s compatibility tools and test critical apps on Windows 11 before mass rollout.
• For older hardware that cannot meet Windows 11 requirements, options include:
• Purchasing new hardware.
• Using ESU for a limited time while planning replacements.
• For advanced hobbyists and some small organizations, third-party lightweight Windows builds and community tools exist (these are not recommended for sensitive environments due to support and security concerns). Any such workaround should be considered high-risk and used only with full understanding of consequences. (tomsguide.com)

---

Final verdict: what this Patch Tuesday tells us about Microsoft’s direction​

September’s updates underline two clear trends:

• Microsoft is accelerating Windows 11 development and AI integration, concentrating new capabilities on Copilot+ hardware and the 24H2/25H2 roadmap. Expect more local-AI features and UX polish to arrive in Windows 11, especially for devices with modern NPUs. (blogs.windows.com)
• Windows 10 is firmly in maintenance mode. The cadence now emphasizes security and reliability through the end-of-support window rather than feature innovation. Organizations still on Windows 10 must pick between migration, ESU, or risk. The October 14, 2025 cutoff is real and imminent; treat ESU as a temporary mitigation rather than a replacement for an upgrade plan. (support.microsoft.com)

For most users the takeaways are straightforward: install the September updates to close critical security holes, evaluate SMB hardening where relevant, and begin or accelerate migration planning if you’re still on Windows 10. For enterprises, the work is messier — test patches and hardening in controlled pilots, map compatibility, and budget for hardware refresh cycles that align with the longer-term Windows 11 feature roadmap.

---

Quick reference: key KBs and CVEs to note​

• KB5065429 — Windows 10 cumulative update (September Patch Tuesday). (support.microsoft.com)
• KB5065426 — Windows 11 cumulative update (September Patch Tuesday). (support.microsoft.com)
• CVE-2025-55234 — SMB Server improper authentication / relay attacks; auditing & hardening guidance included in updates. (cvedetails.com)
• CVE-2024-21907 — Newtonsoft.Json StackOverflow / DoS vulnerability affecting some Microsoft products. (netizen.net)

---

Microsoft’s September Patch Tuesday is an important reminder that security work never stops — even as product strategies change. Apply the patches, review the SMB guidance, and treat Windows 10’s final months as a countdown: patch now, plan carefully, and migrate steadily to protect users and infrastructure. (support.microsoft.com)

---

Source: ZDNET Microsoft gives Windows 10 its penultimate update - but saves the best for Windows 11