CVE-2026-85880 and CVE-2026-81963: Microsoft Patches Two Actively Exploited Windows Zero-Days

Microsoft’s September 2026 Patch Tuesday addresses two Windows privilege escalation vulnerabilities already exploited in the wild. Tracked as CVE-2026-85880 and CVE-2026-81963, both flaws carry a CVSS score of 7.8 and can enable attackers with initial local access to escalate privileges to SYSTEM, potentially turning an initial foothold into complete control over a compromised Windows device.

The first vulnerability affects Windows Advanced Local Procedure Call (ALPC), while the second resides in the Windows Update Stack. Despite targeting different Windows generations and components, both vulnerabilities require low privileges, have low attack complexity, require no user interaction, and have been confirmed as exploited before patches became available. CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog on September 8, 2026, setting September 22 as the remediation deadline for US federal civilian agencies.

Security teams looking for CVE-2026-85880 detection content can explore SOC Prime’s Detection Intelligence to identify behavioral patterns potentially associated with privilege escalation and post-exploitation activity. Click Explore Detections to access detection rules and hunting queries mapped to MITRE ATT&CK® and compatible with multiple SIEM, EDR, and Data Lake technologies.

Defenders can also Detect CVE-2026-81963 exploitation and related post-compromise behavior by focusing on suspicious privilege elevation, system-level file modifications, and anomalous activity involving Windows update processes. Uncoder AI can help security teams convert relevant threat intelligence and indicators into hunting queries and detection logic across multiple security platforms.

Contact Sales

CVE-2026-85880 and CVE-2026-81963 analysis

The CVE-2026-85880 analysis centers on a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), a core Windows mechanism used for communication between processes. According to Microsoft, an attacker who can already execute code inside a low-privilege AppContainer can exploit the vulnerability locally, escape the sandbox, and elevate privileges to SYSTEM. No additional user interaction is required.

The flaw is classified under CWE-122 for heap-based buffer overflow and is rated High with a CVSS v3.1 score of 7.8. The attack vector is local, attack complexity is low, privileges required are low, and successful exploitation can have a high impact on confidentiality, integrity, and availability. The published details for CVE-2026-85880 show that affected systems include Windows 10 versions 1607, 1809, 21H2, and 22H2, along with Windows Server 2012, 2012 R2, 2016, 2019, and 2022, including applicable Server Core installations.

Notably, the affected product range does not include Windows 11 or Windows Server 2025 in Microsoft’s current applicability data. Rapid7 researchers noted that this distinction could potentially be related to Microsoft’s ongoing memory-safety improvements in newer Windows components, although this remains an interpretation rather than an explanation confirmed by Microsoft.

Microsoft credited researchers from Volexity and Proofpoint with reporting the ALPC flaw. However, Microsoft has not disclosed how attackers are currently exploiting it, which threat actors are responsible, or the scale of observed attacks. As of September 9, public reporting also does not identify a verified CVE-2026-85880 PoC, despite confirmed exploitation in real-world attacks.

CVE-2026-81963 is a separate elevation-of-privilege vulnerability affecting the Windows Update Stack. The flaw results from improper link resolution before file access, categorized as CWE-59, together with improper access control under CWE-284. An authorized local attacker can abuse the weakness to elevate privileges to SYSTEM.

CVE-2026-81963 affects newer Windows platforms, including Windows 11 versions 23H2, 24H2, 25H2, and 26H1, as well as Windows Server 2025 and Server Core. This creates an important distinction between the two actively exploited flaws: organizations running older Windows 10 and server generations need to prioritize CVE-2026-85880, while newer Windows 11 and Server 2025 estates require urgent attention to CVE-2026-81963.

The vulnerability also carries a CVSS score of 7.8 and requires local, low-privileged access without user interaction. Security researchers note that local privilege escalation bugs are especially valuable as part of multi-stage attacks. Instead of developing a complex remote exploit that immediately provides SYSTEM access, adversaries can combine an initial access technique with an elevation-of-privilege vulnerability to achieve essentially the same end result.

Microsoft credited Romain Deperne of Airbus Helicopters and the Microsoft Threat Intelligence Center (MSTIC) with the discovery of the Update Stack issue. Microsoft confirmed exploitation before the September security update but has not disclosed information about the threat actors, initial access vectors, or targeted organizations.

As a result, defenders looking for CVE-2026-81963 IOCs should be aware that no campaign-specific indicators have been publicly disclosed by Microsoft in the cited reporting. Detection should therefore prioritize behavioral evidence of privilege escalation, unusual SYSTEM-level activity, suspicious manipulation of files or links, and follow-on actions performed immediately after a low-privilege process gains elevated permissions.

CVE-2026-85880 and CVE-2026-81963 Mitigation

Microsoft released security updates addressing both actively exploited vulnerabilities on September 8, 2026. Because exploitation has already been observed in the wild, organizations should prioritize these updates rather than treating them as part of the normal vulnerability management cycle. CISA’s inclusion of both vulnerabilities in the KEV catalog further reinforces the urgency of patching.

For CVE-2026-85880, administrators should identify vulnerable Windows 10 and Windows Server installations and ensure they have received the corresponding September security updates. Published fixed build thresholds include Windows 10 22H2 build 19045.7725, Windows Server 2016 build 14393.9512, Windows Server 2019 build 17763.9245, and Windows Server 2022 build 20348.5622, with equivalent updates available for the other affected releases.

The recommended CVE-2026-81963 mitigation is similarly straightforward: deploy Microsoft’s September updates to affected Windows 11 and Windows Server 2025 systems. Fixed build levels include Windows 11 23H2 build 22631.7582, Windows 11 24H2 build 26100.9445, Windows 11 25H2 build 26200.9445, Windows 11 26H1 build 28000.2954, and Windows Server 2025 build 26100.33438.

Security teams should verify successful installation across the entire Windows estate rather than relying solely on update deployment status. Because both vulnerabilities are local privilege escalation flaws, monitoring should also focus on potentially compromised low-privilege accounts, sandbox escape behavior, unusual SYSTEM-level processes, unauthorized changes to protected files, and suspicious activity immediately following execution from user-controlled contexts.

Organizations should prioritize systems exposed to untrusted code execution, including user workstations, shared endpoints, development environments, application servers, and systems where an attacker could already obtain limited local access. Privilege escalation vulnerabilities can become particularly dangerous when chained with phishing, malware, browser exploits, stolen credentials, or other initial access techniques.

Additionally, by leveraging SOC Prime’s AI-Native Detection Intelligence Platform backed by collective cyber defense expertise, organizations can strengthen their security posture against emerging zero-day exploitation and accelerate detection engineering across heterogeneous environments.

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.