Three IT Checks for Milwaukee Offices This Week: Patch Tuesday, FortiGate, and Chrome 153

This week's useful work is three concrete jobs: install September's Windows security updates (they close two exploited local privilege bugs and also fix last week's black desktop), confirm FortiGate firmware against a FortiOS bug CISA now lists as exploited, and move Chrome off last week's build onto Chrome 153.

None of these items means every local firm is already compromised. The Windows and Chrome work applies to almost every desk. The Fortinet item only applies if you actually run FortiOS or FortiSwitchManager.

Install September Windows updates, then confirm the build

What happened

Microsoft shipped the September 2026 Patch Tuesday updates on September 8, 2026. BleepingComputer counted 966 flaws in that release, including two that Microsoft treated as actively exploited zero-days. KrebsOnSecurity independently described the batch as at least 974 holes, the company's largest single patch set to date. The two exploited items are:

• CVE-2026-81963: BleepingComputer quotes Microsoft: improper link resolution before file access (link following) in the Windows Update Stack allows an authorized attacker to elevate privileges locally. CISA's catalog wording is a link-following bug that lets an authorized attacker escalate privileges up to SYSTEM.
• CVE-2026-85880: BleepingComputer quotes Microsoft: a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) allows an authorized attacker to elevate privileges locally. CISA's catalog wording is a heap-based buffer overflow that allows an attacker to elevate privileges locally.

CISA added both CVEs to the Known Exploited Vulnerabilities catalog on September 8, 2026, based on evidence of active exploitation. CISA marks ransomware use as unknown for both. The federal due date in the catalog is September 22, 2026 — a BOD 26-04 deadline for federal civilian agencies, not a patch deadline for private businesses. CISA still encourages every organization to treat KEV items as a priority queue.

These are local elevation bugs. They are not a claim that an unauthenticated stranger on the internet can take over a PC with no foothold. They matter because phishing, a malicious installer, or a low-privilege process can use them to become SYSTEM.

The same Windows 11 cumulative, KB5124008 (OS builds 26200.9445 and 26100.9445 for 25H2 and 24H2), is the September 8 security update. Microsoft's KB page says it is not currently aware of any issues with this update. Separately, BleepingComputer quotes Microsoft that the black-desktop personalization bug after the August 27 preview (KB5120998) was resolved by updates released September 8, 2026 (KB5124008) and later.

Krebs also flags CVE-2026-69730, a critical Windows DNS Server remote code execution issue he describes as present from Windows Server 2012 onward and on Windows 10, with an unauthenticated crafted packet and a Microsoft note that exploitation is likely. As of this writing it is not in CISA's KEV catalog. Treat it as part of the same cumulative if you run Windows DNS, not as a third product.

Who is affected

Any office still on supported Windows 10 (including ESU), Windows 11, or Windows Server that has not installed the September 8 security updates.

A PC that already shows KB5124008 (or the matching Server package) and has been rebooted is on the patched floor for those two KEV items, assuming the update actually applied.

Firefox and Chrome are not the products named in CVE-2026-81963 or CVE-2026-85880.

What to check or fix now

1. On a sample of PCs, open Settings, Windows Update, Update history. Confirm KB5124008 on Windows 11 24H2/25H2, or the matching September 8 package on 23H2, Windows 10 ESU, and servers.
2. Reboot. A downloaded update that never restarted does not close the two KEV bugs.
3. If the desktop went black after August 27, install KB5124008 rather than reimaging. Microsoft's quoted guidance is that the September 8 updates resolve that known issue.
4. If you host Windows DNS Server (common on leftover domain controllers), confirm the same cumulative is on that box because of CVE-2026-69730.
5. Do not treat these two KEV items, by themselves, as ransomware. CISA lists ransomware use as unknown.

How to prevent it

Keep Windows on a monthly ring you actually finish, including the reboot. Optional preview updates (the August 27 package) still need a known-issues check before you let them onto the whole office. Related reading: the importance of regular software updates.

FortiGate needs a firmware check, not a guess at "the firewall"

What happened

Fortinet advisory FG-IR-25-084 describes a heap-based buffer overflow in the FortiOS and FortiSwitchManager cw_acd daemon. Fortinet's wording: it may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. Fortinet also wrote that ASLR and PIE considerably raise the complexity and preparation effort required for exploitation.

CISA added CVE-2025-25249 to KEV on September 9, 2026, based on evidence of active exploitation. The catalog names FortiOS, FortiSwitchManager, and FortiSASE, and says the overflow allows an attacker to execute unauthorized code or commands via specially crafted packets. Ransomware use is listed as unknown. The federal due date in that catalog row is September 12, 2026.

Fortinet's fixed floors in the advisory are:

• FortiOS 7.6: 7.6.4 or above (affected 7.6.0 through 7.6.3)
• FortiOS 7.4: 7.4.9 or above (affected 7.4.0 through 7.4.8)
• FortiOS 7.2: 7.2.12 or above (affected 7.2.0 through 7.2.11)
• FortiOS 7.0: 7.0.18 or above (affected 7.0.0 through 7.0.17)
• FortiOS 6.4: all versions affected; migrate to a fixed release
• FortiSwitchManager 7.2: 7.2.7 or above
• FortiSwitchManager 7.0: 7.0.6 or above

Fortinet's workaround, if you cannot patch immediately, is to remove fabric access from each interface, or to restrict CAPWAP-CONTROL (UDP 5246-5249) with a local-in policy.

This is a January 2026 patch that CISA listed as exploited in September.

Who is affected

Offices that run FortiGate / FortiOS, FortiSwitchManager, or FortiSASE on a build in Fortinet's affected ranges. That is a common Milwaukee-area firewall, but only the Fortinet operating systems above are in scope — not "any box with a vendor logo."

A SonicWall TZ, UniFi gateway, or Cisco ASA is a different product. A firm with no Fortinet OS can skip this item.

Risk is higher if the management or fabric-facing interfaces are on the public internet. CISA's catalog language tells stakeholders to evaluate internet exposure.

What to check or fix now

1. Inventory: is there a FortiGate, FortiSwitchManager, or FortiSASE tenant, including a leftover VM?
2. Record the FortiOS (or FortiSwitchManager) version from the GUI or CLI.
3. If you are below Fortinet's fixed floor for that branch, plan the upgrade Fortinet listed. FortiOS 6.4 has no in-branch fix in this advisory; Fortinet says migrate.
4. If you cannot patch this week, remove fabric from allowaccess on each interface, per Fortinet.
5. If the firewall was internet-facing and unpatched after CISA listed exploitation, treat it as an incident lead: review admin accounts, VPN sessions, and unexpected processes. CISA lists ransomware use as unknown.

How to prevent it

Put FortiOS on the same monthly list as Windows. Keep admin and fabric services off the whole internet. Subscribe to Fortinet PSIRT so a January advisory is not still waiting in September. Related reading: why your business needs a strong firewall.

Chrome 153 is a new V8 bug, not last week's Chrome 152 patch

What happened

Google promoted Chrome 153 to the stable channel: 153.0.8010.36 on Linux and 153.0.8010.36/.37 on Windows and Mac. The post lists 230 security fixes, including CVE-2026-87491, an out-of-bounds write in V8 reported as Medium.

CISA added CVE-2026-87491 to KEV on September 9, 2026. Catalog wording: Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. CISA also says the issue could affect multiple Chromium browsers, including Google Chrome, Microsoft Edge, and Opera. Ransomware use is unknown. The federal due date in that row is September 23, 2026.

This is not CVE-2026-85046 from last week's coverage (Chrome 152.0.7977.82). That was a different V8 type-confusion bug. A PC that patched last week still needs this week's Chrome 153 build.

CISA's language is renderer-sandbox code execution from a malicious page, not a claim that the bug already escapes the sandbox or encrypts files.

Who is affected

Any office where staff browse the web in Chrome or another Chromium browser.

Not every Chromium fork shipped the fix on the same day. Microsoft's Edge security notes reviewed for this update still describe the September 2 Edge Stable 152.0.4191.62 fix for CVE-2026-85046, and later 152.0.4191.66 on September 4; they do not yet name a Chrome 153-based Edge build for CVE-2026-87491. Check About Microsoft Edge after you update Chrome, and do not assume Edge is done because Chrome is.

Firefox and Safari are outside CISA's Chromium wording for this CVE.

What to check or fix now

1. On a sample of PCs, open Chrome, Settings, About Chrome. Confirm 153.0.8010.36 or 153.0.8010.37 or later, then fully quit and reopen the browser.
2. On Edge, open Settings, About Microsoft Edge and record the version. If it is still on the 152.0.4191.x line, keep checking until Microsoft publishes a Chromium 153 ingest. CISA's KEV row still names Edge as a possible affected Chromium browser.
3. Repeat for leftover Chrome on a terminal server, a shop-floor PC, or a partner laptop that opens client portals.
4. Do not treat this CVE, by itself, as ransomware. CISA lists ransomware use as unknown.

How to prevent it

Keep Chrome and Edge on the same ring as Windows. Disable user-installed Chromium copies that never get policy. Related reading: the importance of regular software updates.

What to do this week

1. Deploy the September 8 Windows security updates (KB5124008 on current Windows 11 24H2/25H2) and reboot. That closes CVE-2026-81963 and CVE-2026-85880 and, per Microsoft as quoted by BleepingComputer, the black-desktop bug after KB5120998.
2. If you run Windows DNS Server, confirm the same cumulative is on that host.
3. Record FortiOS / FortiSwitchManager version. If you are below Fortinet's table, upgrade, or remove fabric access until you can.
4. Move Chrome to 153.0.8010.36/.37 or later and restart the browser.
5. Check Edge About until it is no longer on the 152 line, because CISA's KEV row for CVE-2026-87491 names Chromium browsers including Edge.

Milwaukee businesses can ask Manage IT / Powerful IT to run the same five checks and report what is actually installed. No need to guess from vendor marketing mail.

Sources

• CISA, September 8, 2026: four known exploited vulnerabilities added to the catalog
• CISA, September 9, 2026: four known exploited vulnerabilities added to the catalog
• CISA Known Exploited Vulnerabilities catalog (JSON)
• BleepingComputer, September 8, 2026: September Patch Tuesday fixes 966 flaws, 2 zero-days
• KrebsOnSecurity, September 8, 2026: Microsoft plugs nearly 1000 security holes
• BleepingComputer: Microsoft fixes bug that wiped Windows desktop settings
• Microsoft KB5124008 Windows 11 24H2/25H2 security update
• Fortinet FG-IR-25-084 (CVE-2025-25249)
• Google Chrome Stable channel update for Desktop (Chrome 153)
• Microsoft Edge security release notes