- The Mess: Microsoft just patched two Windows privilege-escalation zero-days that were already being exploited. One abuses ALPC. The other abuses the Windows Update Stack.
- The Damage: Both can turn a low-privileged foothold into full SYSTEM-level control.
- The Fix: Install the September 2026 Windows security updates now — these are not “patch later” vulnerabilities.
Microsoft’s September security release came with the usual mountain of CVEs. Two deserve a much shorter response: CVE-2026-85880 and CVE-2026-81963.
Both are rated CVSS 7.8. Both require local access. Both require no user interaction. And Microsoft says both have already been exploited in the wild. CISA added both to its Known Exploited Vulnerabilities catalog on September 8.
CVE-2026-85880: ALPC becomes the escape hatch
The first bug sits in Windows Advanced Local Procedure Call (ALPC).
CVE-2026-85880 is a heap-based buffer overflow. An attacker who can execute code with low privileges can abuse the flaw to elevate privileges and reach SYSTEM.
The interesting part is the AppContainer angle.
An attacker doesn’t necessarily need administrator access first. A low-privileged process running inside an AppContainer can use the ALPC flaw to escape that sandbox and obtain SYSTEM privileges.
That turns a relatively restricted execution context into complete control of the Windows host.
For defenders, this is exactly the sort of vulnerability that makes application sandboxing less comforting than it looks on paper.
CVE-2026-81963: Windows Update has a link-following problem
The second zero-day is CVE-2026-81963, a link-following vulnerability in the Windows Update Stack.
The attacker again needs local access, but the vulnerable component can be abused to elevate privileges to SYSTEM. The problem is classified under CWE-59, involving improper handling of links before file access.
Windows Update is obviously not some obscure third-party utility.
It is part of the operating system’s trusted machinery.
That makes exploitation particularly valuable after an attacker has already landed on a machine through phishing, stolen credentials, malware, or another vulnerability.
The first foothold doesn’t need to be SYSTEM.
These bugs can finish the job.
This is why CISA moved fast
CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on September 8, one day after their public disclosure.
For CVE-2026-81963, CISA’s federal remediation deadline is September 22. The same deadline applies to CVE-2026-85880.
That is a useful signal even for organizations that aren’t U.S. federal agencies.
When a Windows local privilege-escalation bug is simultaneously:
- newly disclosed,
- actively exploited,
- capable of reaching SYSTEM,
- and already listed by CISA,
the vulnerability management queue should stop treating it like another CVE.
The ugly part: both bugs fit attack chains
Neither vulnerability is a remote unauthenticated RCE.
That sounds less scary.
It isn’t.
Modern attacks rarely depend on a single vulnerability doing everything. An attacker gets onto a workstation, gains execution under a restricted account, steals a credential, abuses a browser, opens a malicious document — and then looks for a privilege boundary to cross.
CVE-2026-85880 and CVE-2026-81963 provide exactly that second step.
Once SYSTEM is obtained, security controls, credentials, services and protected files become much easier targets.
Bugstoday Opinion
Two Windows zero-days being exploited at the same time isn’t unusual anymore.
What matters is where they sit in the attack chain.
Both vulnerabilities are privilege escalators, which means attackers don’t need them to get through the front door. They need them after they’ve already found a way inside.
And that’s precisely why these bugs are dangerous.
If your endpoint is already compromised, the attacker doesn’t care whether the initial malware had administrator rights.
They can try to manufacture them.
Patch Windows. Then hunt for the foothold that made these exploits useful in the first place.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- Microsoft Security Update — September 2026
- CVE-2026-85880 — Windows ALPC heap-based buffer overflow
- CVE-2026-81963 — Windows Update Stack link-following vulnerability
- CISA Known Exploited Vulnerabilities — both CVEs added September 8, 2026
- Zero Day Initiative — September 2026 Patch Tuesday analysis
