2026-09-09 · view entry permalink →
September 2026 Patch Tuesday: two actively exploited Windows privilege-escalation zero-days (CVE-2026-81963 Update Stack, CVE-2026-85880 ALPC)
Microsoft's September 2026 Patch Tuesday marked exactly two of its roughly 1,170 fixed CVEs as exploited in the wild, and both are local privilege-escalation bugs that raise an existing low-privilege foothold to SYSTEM rather than remote-entry vectors (Microsoft MSRC, 2026-09-08; Zero Day Initiative, 2026-09-08). CVE-2026-81963 (CVSS 7.8) is an improper-link-resolution flaw in the Windows Update Stack: "Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally" (Microsoft MSRC, 2026-09-08); it affects the newest generation, Windows Server 2025 and Windows 11 (23H2 through 26H1), and Microsoft's own CVSS temporal metric records a functional exploit (E:F). CVE-2026-85880 (CVSS 7.8) is a heap-based buffer overflow in Windows ALPC, the core local inter-process-communication mechanism, which Microsoft describes explicitly as a sandbox escape: "An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system. No additional user interaction is required" (Microsoft MSRC, 2026-09-08); it affects only the legacy/long-support line, Windows 10 and Windows Server 2012 through 2022, and not Windows 11 or Server 2025 (BleepingComputer, 2026-09-08). The two zero-days split cleanly across the newest and legacy Windows generations, so a mixed estate needs both September cumulative updates to close the exposure.
Neither Microsoft nor the crediting researchers (its own Threat Intelligence Center with Romain Deperne for the Update Stack bug; Volexity and Proofpoint for the ALPC bug) published IOCs, a named intrusion cluster, or exploitation-chain detail, and ZDI notes the scope of exploitation is unknown: "This is the first bug being exploited in the wild, but we know little about how broadly that exploitation is. The bug itself is a privilege escalation in the Update Stack, which is worrisome, but I doubt the automatic update process itself is compromised. More likely is that this bug is being combined with a code execution bug to spread malware or ransomware. Patch this one quickly" (Zero Day Initiative, 2026-09-08). Because both are post-foothold escalation primitives, the actionable telemetry class is process-creation and privilege-token events that follow a lower-integrity code-execution event on the same host: a Windows Update service-context process performing file operations through a symbolic link, or a sandboxed AppContainer process acquiring a higher-integrity or SYSTEM token, correlated with a preceding lower-privilege, non-installer execution. No workaround exists for either bug class, so the September cumulative updates are the only mitigation; CISA added both to its Known Exploited Vulnerabilities catalog on 2026-09-08 (CISA, 2026-09-08). The KEV remediation date is a US-agency compliance deadline; the operational driver for the Swiss federal, cantonal and communal AD and endpoint estate is the confirmed active exploitation, which makes both fixes a prioritized rollout rather than a routine Patch Tuesday item.
Triage: both bugs manifest only after an attacker already runs code on the host, so the signal is a privilege transition, not an initial-access event: a low-integrity or AppContainer-sandboxed process acquiring a SYSTEM or higher-integrity token with no legitimate installer or servicing context is the discriminator. Routine software installation and Windows servicing also elevate to SYSTEM, so correlate the token change with a preceding low-privilege, non-installer execution rather than alerting on elevation alone.
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system. No additional user interaction is required.
This is the first bug being exploited in the wild, but we know little about how broadly that exploitation is. The bug itself is a privilege escalation in the Update Stack, which is worrisome, but I doubt the automatic update process itself is compromised. More likely is that this bug is being combined with a code execution bug to spread malware or ransomware. Patch this one quickly.