---
schema: 1
kind: vulnerability
title: "September 2026 Patch Tuesday: two actively exploited Windows privilege-escalation zero-days (CVE-2026-81963 Update Stack, CVE-2026-85880 ALPC)"
headline: "Microsoft names two exploited Windows privilege-escalation zero-days, splitting the newest and legacy build lines"
summary: >
  Microsoft's September 2026 Patch Tuesday (2026-09-08) flagged exactly two of its roughly 1,170 fixed
  CVEs as exploited in the wild, both local privilege-escalation zero-days now on CISA KEV: CVE-2026-81963
  in the Windows Update Stack, affecting the newest builds (Windows Server 2025 and Windows 11), and
  CVE-2026-85880 in Windows ALPC, affecting the legacy line (Windows 10 and Windows Server 2012 through
  2022). Both raise a low-privilege foothold to SYSTEM, so a mixed estate needs both September cumulative
  updates to close the exposure.
discovered_at: "2026-09-09T17:45:00Z"
updated_at: null
event_date: "2026-09-08"
run_id: 2026-09-09T1726Z-intel
priority: high
immediate_action: null
tags: [vulnerabilities, lpe, priv-esc, actively-exploited, zero-day, cisa-kev, patch-available]
regions: [global]
sectors: [public-sector]
entities: []
techniques: [T1068]
affected_products: ["Microsoft Windows Server 2025", "Microsoft Windows 11", "Microsoft Windows 10", "Microsoft Windows Server 2012", "Microsoft Windows Server 2012 R2", "Microsoft Windows Server 2016", "Microsoft Windows Server 2019", "Microsoft Windows Server 2022"]
cves:
  - id: CVE-2026-81963
    cvss: "7.8"
    epss: null
    type: lpe
    vector: local
    auth: post-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "Windows Server 2025 and Windows 11 (23H2, 24H2, 25H2, 26H1) — the newest generation"
    fixed: "September 2026 cumulative update (per-build KBs listed in Microsoft's advisory)"
  - id: CVE-2026-85880
    cvss: "7.8"
    epss: null
    type: lpe
    vector: local
    auth: post-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 — the legacy/long-support line only; not Windows 11 or Server 2025"
    fixed: "September 2026 cumulative update (per-build KBs listed in Microsoft's advisory)"
sources:
  - url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963"
    publisher: "Microsoft MSRC"
    date: "2026-09-08"
    role: primary
  - url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880"
    publisher: "Microsoft MSRC"
    date: "2026-09-08"
    role: primary
  - url: "https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog"
    publisher: "CISA"
    date: "2026-09-08"
    role: primary
  - url: "https://www.zerodayinitiative.com/blog/2026/9/8/the-september-2026-security-update-review"
    publisher: "Zero Day Initiative (Trend Micro)"
    date: "2026-09-08"
    role: corroborating
  - url: "https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/"
    publisher: "BleepingComputer"
    date: "2026-09-08"
    role: corroborating
closed_sources: []
evidence:
  - quote: "Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally."
    publisher: "Microsoft MSRC"
    source_url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963"
  - quote: "An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system. No additional user interaction is required."
    publisher: "Microsoft MSRC"
    source_url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880"
  - quote: "This is the first bug being exploited in the wild, but we know little about how broadly that exploitation is. The bug itself is a privilege escalation in the Update Stack, which is worrisome, but I doubt the automatic update process itself is compromised. More likely is that this bug is being combined with a code execution bug to spread malware or ransomware. Patch this one quickly."
    publisher: "Zero Day Initiative (Trend Micro)"
    source_url: "https://www.zerodayinitiative.com/blog/2026/9/8/the-september-2026-security-update-review"
verification: multi-source
sourcing_note: "Microsoft rates both zero-days Important, not Critical, and neither Microsoft nor the crediting researchers have released IOCs, a named intrusion cluster, or exploitation-chain detail. CVSS base scores and the exploitation flag are transcribed from each MSRC per-CVE record; the KEV listing is from CISA's 2026-09-08 alert."
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 1
watchlist_hit: false
actions:
  - "Deploy the September 2026 cumulative update to every Windows and Windows Server host now: the Update Stack fix (CVE-2026-81963) covers Server 2025 and Windows 11, the ALPC fix (CVE-2026-85880) covers Windows 10 and Server 2012 through 2022, and a mixed estate needs both to close the SYSTEM-escalation exposure."
updates: []
migrated_from: null
---

Microsoft's September 2026 Patch Tuesday marked exactly two of its roughly 1,170 fixed CVEs as exploited in the wild, and both are local privilege-escalation bugs that raise an existing low-privilege foothold to SYSTEM rather than remote-entry vectors ([Microsoft MSRC, 2026-09-08](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963); [Zero Day Initiative, 2026-09-08](https://www.zerodayinitiative.com/blog/2026/9/8/the-september-2026-security-update-review)). CVE-2026-81963 (CVSS 7.8) is an improper-link-resolution flaw in the Windows Update Stack: "Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally" ([Microsoft MSRC, 2026-09-08](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963)); it affects the newest generation, Windows Server 2025 and Windows 11 (23H2 through 26H1), and Microsoft's own CVSS temporal metric records a functional exploit (E:F). CVE-2026-85880 (CVSS 7.8) is a heap-based buffer overflow in Windows ALPC, the core local inter-process-communication mechanism, which Microsoft describes explicitly as a sandbox escape: "An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system. No additional user interaction is required" ([Microsoft MSRC, 2026-09-08](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880)); it affects only the legacy/long-support line, Windows 10 and Windows Server 2012 through 2022, and not Windows 11 or Server 2025 ([BleepingComputer, 2026-09-08](https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/)). The two zero-days split cleanly across the newest and legacy Windows generations, so a mixed estate needs both September cumulative updates to close the exposure.

Neither Microsoft nor the crediting researchers (its own Threat Intelligence Center with Romain Deperne for the Update Stack bug; Volexity and Proofpoint for the ALPC bug) published IOCs, a named intrusion cluster, or exploitation-chain detail, and ZDI notes the scope of exploitation is unknown: "This is the first bug being exploited in the wild, but we know little about how broadly that exploitation is. The bug itself is a privilege escalation in the Update Stack, which is worrisome, but I doubt the automatic update process itself is compromised. More likely is that this bug is being combined with a code execution bug to spread malware or ransomware. Patch this one quickly" ([Zero Day Initiative, 2026-09-08](https://www.zerodayinitiative.com/blog/2026/9/8/the-september-2026-security-update-review)). Because both are post-foothold escalation primitives, the actionable telemetry class is process-creation and privilege-token events that follow a lower-integrity code-execution event on the same host: a Windows Update service-context process performing file operations through a symbolic link, or a sandboxed AppContainer process acquiring a higher-integrity or SYSTEM token, correlated with a preceding lower-privilege, non-installer execution. No workaround exists for either bug class, so the September cumulative updates are the only mitigation; CISA added both to its Known Exploited Vulnerabilities catalog on 2026-09-08 ([CISA, 2026-09-08](https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog)). The KEV remediation date is a US-agency compliance deadline; the operational driver for the Swiss federal, cantonal and communal AD and endpoint estate is the confirmed active exploitation, which makes both fixes a prioritized rollout rather than a routine Patch Tuesday item.

**Triage:** both bugs manifest only after an attacker already runs code on the host, so the signal is a privilege transition, not an initial-access event: a low-integrity or AppContainer-sandboxed process acquiring a SYSTEM or higher-integrity token with no legitimate installer or servicing context is the discriminator. Routine software installation and Windows servicing also elevate to SYSTEM, so correlate the token change with a preceding low-privilege, non-installer execution rather than alerting on elevation alone.