On 8 September 2026 Microsoft shipped its September security updates and confirmed that two Windows flaws were being exploited. CISA added both to the KEV catalog the same day with a due date of 22 September. Both are local privilege escalation bugs, so they matter after an attacker already has a foothold.
The release was also the largest on record. Counts vary by source: CrowdStrike reports 972 CVEs, and Malwarebytes reports that Microsoft lists 974, of which 964 need customer action.
What's affected
| Item | CVE-2026-81963 | CVE-2026-85880 |
|---|---|---|
| Component | Windows Update Stack | Windows Advanced Local Procedure Call (ALPC) |
| Bug class | Link following (CWE-59, CWE-284) | Heap-based buffer overflow (CWE-122, CWE-908) |
| Effect | Local escalation up to SYSTEM | Local privilege escalation, reported to include escape from a low-privilege AppContainer |
| CVSS 3.1 (NVD) | 7.8 | 7.8 |
| KEV added / due | 8 Sep 2026 / 22 Sep 2026 | 8 Sep 2026 / 22 Sep 2026 |
The KEV entries do not list product builds, and the sources we could fetch do not list KB numbers, so use Microsoft's Security Update Guide pages for the exact update per Windows version. CrowdStrike's write-up says both components run on every supported Windows version. Neither entry is flagged for forensic triage in the catalog, and ransomware use is listed as unknown.
Microsoft has not said who exploited the bugs or how widely.
How to check if you're exposed
The fix is the September 2026 cumulative update for your Windows version. Confirm it is installed:
# OS version and build
Get-ComputerInfo | Select-Object WindowsProductName, OsBuildNumber, OsHardwareAbstractionLayer
# Most recent installed updates
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Compare the installed date and build with the update listed on the MSRC page for each CVE. To see where you stand fleet wide, query your patch tool for machines that have not installed an update dated 8 September 2026 or later.
Because both bugs need local access first, look at who can run code on your machines: shared build hosts, jump boxes, terminal servers and developer laptops are the high value ones.
What to do now
- Deploy the 8 September 2026 updates, starting with servers where many users or services run code.
- Treat the KEV due date of 22 September as the outer bound, and note that the BOD 26-04 timelines can be shorter for internet exposed assets.
- Look for earlier signs of a foothold on unpatched systems: new local admin accounts, unexpected services, and EDR alerts for SYSTEM processes spawned by low-privilege parents.
- Restrict who can log on interactively to servers, since local privilege escalation needs a local session.
- Re-run your patch compliance report after the window and chase machines that failed to install.
Why it matters
A privilege escalation bug rarely starts an intrusion. It turns a low-value foothold, such as a phished user or a compromised service account, into full control of the machine. That is why these two entries get attention even though their CVSS scores of 7.8 look modest.
The ALPC bug is a sandbox concern too. The reported ability to leave a low-privilege AppContainer means that code confined by a sandbox, like a document parser or browser renderer, can be used to reach SYSTEM when paired with another flaw.
Quick check
Why do these two Important rated bugs deserve a patch deadline of days, not weeks?
Both are confirmed as exploited, and CISA listed them in KEV with a 22 September due date. Exploitation status matters more than the 7.8 score.
