Nearly half the CVEs Microsoft disclosed in its September security update, including one publicly known bug, enable escalation of privileges.