Microsoft’s September security release patches two Windows privilege-escalation vulnerabilities that the company says are already being exploited. CISA added both CVE-2026-85880 and CVE-2026-81963 to its Known Exploited Vulnerabilities catalog on September 8.
What changed
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call. Microsoft says an attacker who can already run code inside a low-privilege AppContainer can use the flaw locally to escape that sandbox and obtain SYSTEM privileges without additional user interaction.
CVE-2026-81963 is an improper-link-resolution flaw in the Windows Update Stack. Microsoft says a locally authorized attacker can exploit it to gain SYSTEM privileges. The company rates both vulnerabilities Important with CVSS base scores of 7.8, marks both as exploited, and says neither was publicly disclosed before the release.
The practical consequence
Windows administrators should prioritize the September cumulative updates rather than waiting for routine patch windows to drift. CISA’s catalog lists a September 22 due date for covered federal civilian agencies and tells other organizations to use the catalog as a vulnerability-prioritization input. The two flaws are local privilege escalations, not unauthenticated remote compromises, but they can turn an initial low-privilege foothold into full control of an affected machine.
Check the affected-product tables
The affected versions are not identical. Microsoft’s machine-readable advisory lists CVE-2026-85880 across several Windows 10 and Windows Server generations, while CVE-2026-81963 includes supported Windows 11 releases and Windows Server 2025. Administrators should match each device to Microsoft’s update table instead of assuming one Windows build or one KB covers every supported edition.
Limits of the disclosure
Microsoft and CISA do not identify the attackers, targets, exploitation scale, or initial-access method. CISA marks ransomware use as unknown. The public notices also do not establish that either flaw can be exploited remotely by itself; Microsoft’s vectors require local access and low privileges. Details about the observed attacks remain limited, so claims about a specific campaign or exploit chain would go beyond the evidence.
Benchmark status
No performance benchmark applies. This report is based on Microsoft’s September release data and CISA’s exploitation catalog; DrComps did not reproduce either vulnerability or observe the attacks independently.