Windows Update Stack link-following EoP to SYSTEM (CVSS 7.8), actively exploited zero-day, CISA KEV 2026-09-08, newest builds (Server 2025, Windows 11)

September 2026 Patch Tuesday: two actively exploited Windows privilege-escalation zero-days (CVE-2026-81963 Update Stack, CVE-2026-85880 ALPC)

Microsoft's September 2026 Patch Tuesday marked exactly two of its 966 fixed CVEs as exploited in the wild (BleepingComputer, 2026-09-08), and both are local privilege-escalation bugs that raise an existing low-privilege foothold to SYSTEM rather than remote-entry vectors (Microsoft MSRC, 2026-09-08; Zero Day Initiative, 2026-09-08). CVE-2026-81963 (CVSS 7.8) is an improper-link-resolution flaw in the Windows Update Stack: "Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally" (Microsoft MSRC, 2026-09-08); it affects the newest generation, Windows Server 2025 and Windows 11 (23H2 through 26H1), and Microsoft's own CVSS temporal metric records a functional exploit (E:F). CVE-2026-85880 (CVSS 7.8) is a heap-based buffer overflow in Windows ALPC, the core local inter-process-communication mechanism, which Microsoft describes explicitly as a sandbox escape: "An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system. No additional user interaction is required" (Microsoft MSRC, 2026-09-08); it affects only the legacy/long-support line, Windows 10 and Windows Server 2012 through 2022, and not Windows 11 or Server 2025 (BleepingComputer, 2026-09-08). The two zero-days split cleanly across the newest and legacy Windows generations, so a mixed estate needs both September cumulative updates to close the exposure.

Neither Microsoft nor the crediting researchers (its own Threat Intelligence Center with Romain Deperne for the Update Stack bug; Volexity and Proofpoint for the ALPC bug) published IOCs, a named intrusion cluster, or exploitation-chain detail, and ZDI notes the scope of exploitation is unknown: "This is the first bug being exploited in the wild, but we know little about how broadly that exploitation is. The bug itself is a privilege escalation in the Update Stack, which is worrisome, but I doubt the automatic update process itself is compromised. More likely is that this bug is being combined with a code execution bug to spread malware or ransomware. Patch this one quickly" (Zero Day Initiative, 2026-09-08). Because both are post-foothold escalation primitives, the actionable telemetry class is process-creation and privilege-token events that follow a lower-integrity code-execution event on the same host: a Windows Update service-context process performing file operations through a symbolic link, or a sandboxed AppContainer process acquiring a higher-integrity or SYSTEM token, correlated with a preceding lower-privilege, non-installer execution. No workaround exists for either bug class, so the September cumulative updates are the only mitigation; CISA added both to its Known Exploited Vulnerabilities catalog on 2026-09-08 (CISA, 2026-09-08). The KEV remediation date is a US-agency compliance deadline; the operational driver for the Swiss federal, cantonal and communal AD and endpoint estate is the confirmed active exploitation, which makes both fixes a prioritized rollout rather than a routine Patch Tuesday item.

Triage: both bugs manifest only after an attacker already runs code on the host, so the signal is a privilege transition, not an initial-access event: a low-integrity or AppContainer-sandboxed process acquiring a SYSTEM or higher-integrity token with no legitimate installer or servicing context is the discriminator. Routine software installation and Windows servicing also elevate to SYSTEM, so correlate the token change with a preceding low-privilege, non-installer execution rather than alerting on elevation alone.