Microsoft’s recent Patch Tuesday, dated September 2026, has drawn attention for addressing two critical Windows privilege escalation vulnerabilities that have already been exploited in the wild. These vulnerabilities, identified as CVE-2026-85880 and CVE-2026-81963, both carry a CVSS score of 7.8, highlighting their severity. They allow attackers with initial local access to escalate their privileges to SYSTEM, potentially granting them complete control over compromised Windows devices.
The first vulnerability, CVE-2026-85880, is rooted in the Windows Advanced Local Procedure Call (ALPC), a fundamental mechanism for inter-process communication. The second, CVE-2026-81963, is associated with the Windows Update Stack. Despite their different targets within the Windows ecosystem, both vulnerabilities share common characteristics: they require low privileges, exhibit low attack complexity, necessitate no user interaction, and have been confirmed as actively exploited prior to the release of patches. The Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on September 8, 2026, establishing a remediation deadline of September 22 for U.S. federal civilian agencies.
For security teams seeking detection capabilities for CVE-2026-85880, SOC Prime’s Detection Intelligence offers valuable insights into behavioral patterns that may indicate privilege escalation and post-exploitation activities. By exploring detection rules and hunting queries aligned with MITRE ATT&CK®, teams can enhance their monitoring efforts across various SIEM, EDR, and Data Lake technologies.
Similarly, defenders can identify potential exploitation of CVE-2026-81963 by focusing on signs of suspicious privilege elevation, system-level file modifications, and unusual activities related to Windows update processes. Tools like Uncoder AI can assist security teams in transforming relevant threat intelligence into actionable hunting queries and detection logic across multiple security platforms.
CVE-2026-85880 and CVE-2026-81963 analysis
The analysis of CVE-2026-85880 reveals a heap-based buffer overflow within the Windows ALPC. Microsoft indicates that an attacker capable of executing code within a low-privilege AppContainer can exploit this vulnerability locally, effectively escaping the sandbox and elevating their privileges to SYSTEM without requiring additional user interaction.
This flaw is classified under CWE-122 for heap-based buffer overflow and is rated High, with a CVSS v3.1 score of 7.8. The attack vector is local, with low attack complexity and privilege requirements. Successful exploitation can significantly impact confidentiality, integrity, and availability. Affected systems include various Windows 10 versions and several Windows Server editions, while notably excluding Windows 11 and Windows Server 2025, possibly due to ongoing memory-safety enhancements in newer Windows components.
Microsoft has acknowledged the contributions of researchers from Volexity and Proofpoint in reporting the ALPC flaw. However, details regarding the methods of exploitation, responsible threat actors, or the scale of attacks remain undisclosed. As of September 9, there is no verified proof of concept (PoC) for CVE-2026-85880, despite confirmed exploitation in real-world scenarios.
CVE-2026-81963, on the other hand, is a distinct elevation-of-privilege vulnerability affecting the Windows Update Stack. This flaw arises from improper link resolution prior to file access, categorized as CWE-59, in conjunction with improper access control under CWE-284. An authorized local attacker can exploit this weakness to elevate privileges to SYSTEM.
This vulnerability impacts newer Windows platforms, including various versions of Windows 11 and Windows Server 2025. This distinction emphasizes the need for organizations running older Windows 10 and server generations to prioritize CVE-2026-85880, while those utilizing newer systems must urgently address CVE-2026-81963.
Similar to CVE-2026-85880, CVE-2026-81963 carries a CVSS score of 7.8 and requires local, low-privileged access without user interaction. Security researchers highlight the value of local privilege escalation bugs in multi-stage attacks, as they allow adversaries to combine initial access techniques with elevation-of-privilege vulnerabilities to achieve SYSTEM access more efficiently.
Microsoft has credited Romain Deperne from Airbus Helicopters and the Microsoft Threat Intelligence Center for discovering the Update Stack issue. While Microsoft has confirmed exploitation prior to the September security update, specific details about the threat actors or initial access vectors have not been disclosed. Consequently, defenders should focus on behavioral evidence of privilege escalation and unusual SYSTEM-level activities when monitoring for CVE-2026-81963.
CVE-2026-85880 and CVE-2026-81963 Mitigation
In light of the observed exploitation of both vulnerabilities, Microsoft released security updates on September 8, 2026. Organizations are advised to prioritize these updates rather than treating them as part of the standard vulnerability management cycle. CISA’s inclusion of both vulnerabilities in the KEV catalog underscores the urgency of patching.
For CVE-2026-85880, administrators should identify vulnerable Windows 10 and Windows Server installations and ensure they have received the corresponding September security updates. The fixed build thresholds include various Windows 10 and Server versions, with equivalent updates available for other affected releases.
Similarly, for CVE-2026-81963, deploying Microsoft’s September updates to affected Windows 11 and Windows Server 2025 systems is crucial. Fixed build levels for these systems are also specified, ensuring comprehensive coverage for all affected platforms.
Security teams should verify the successful installation of updates across their entire Windows estate, rather than relying solely on deployment status. Monitoring efforts should concentrate on potentially compromised low-privilege accounts, sandbox escape behavior, unusual SYSTEM-level processes, unauthorized changes to protected files, and suspicious activities following execution from user-controlled contexts.
Organizations must prioritize systems exposed to untrusted code execution, including user workstations, shared endpoints, and development environments. The potential danger of privilege escalation vulnerabilities increases when combined with phishing, malware, or other initial access techniques.
By leveraging SOC Prime’s AI-Native Detection Intelligence Platform, organizations can bolster their security posture against emerging threats and enhance detection engineering across diverse environments.
FAQ
What are CVE-2026-85880 and CVE-2026-81963 and how do they work?
CVE-2026-85880 is a heap-based buffer overflow vulnerability in Windows ALPC that allows an attacker with low-privilege local code execution to escape an AppContainer sandbox and gain SYSTEM privileges. CVE-2026-81963 is an improper link resolution vulnerability in the Windows Update Stack that similarly allows a local, authorized attacker to elevate privileges to SYSTEM. Both vulnerabilities require no additional user interaction and have a CVSS score of 7.8.
When were CVE-2026-85880 and CVE-2026-81963 first discovered?
Microsoft publicly disclosed and patched both vulnerabilities on September 8, 2026. The precise original discovery dates have not been publicly provided. Volexity and Proofpoint were credited for reporting CVE-2026-85880, while Romain Deperne of Airbus Helicopters and Microsoft Threat Intelligence Center were credited with CVE-2026-81963.
What is the impact of CVE-2026-85880 and CVE-2026-81963 on systems?
Successful exploitation of either vulnerability can grant an attacker SYSTEM privileges, the highest practical privilege level on a Windows host. This access could enable the attacker to disable security controls, access sensitive information, modify protected files, establish persistence, steal credentials, and use the compromised machine for lateral movement or additional payload deployment. Both flaws have been confirmed to be exploited in the wild.
Can CVE-2026-85880 and CVE-2026-81963 still affect me in 2026?
Yes. Any affected system that has not received the September 2026 Microsoft security updates remains vulnerable. The risk is particularly significant because exploitation was observed before Microsoft released the fixes, and CISA added both vulnerabilities to its KEV catalog on September 8, 2026.
How can I protect myself from CVE-2026-85880 and CVE-2026-81963?
Install Microsoft’s September 2026 security updates on all affected systems as soon as possible and verify that devices have reached the patched build level. Prioritize systems where attackers could obtain local code execution, monitor for suspicious privilege escalation and SYSTEM-level behavior, reduce unnecessary local administrator access, and investigate potentially compromised accounts or endpoints rather than relying on patch deployment alone.
