"Microsoft just patched two Windows flaws attackers were already using"

The headline number

Microsoft's September 2026 Patch Tuesday landed with 973 fixes, one of the largest batches the company has shipped. Buried in that pile are two vulnerabilities that matter more than the rest combined, because attackers were already using them before a patch existed.

CVE-2026-85880 sits in the Windows Advanced Local Procedure Call component and lets an attacker who already has a foothold on a machine escalate to higher privileges. CVE-2026-81963 does something similar through the Windows Update Stack, handing attackers SYSTEM level access once they are in. Neither is a way to break in from the outside. Both are the tool an attacker reaches for once they are already inside, turning a low-level compromise into full control of the machine.

Both carry a CVSS score of 7.8, which sounds moderate next to some of the critical remote code execution bugs in the same batch. Severity scores measure the wrong thing here. What matters is that CISA has already added both to its Known Exploited Vulnerabilities catalogue, confirming active use against real targets, and federal civilian agencies in the US have until 22 September 2026, 23:59 EDT, to patch.

Why privilege escalation bugs are the quiet danger

Ransomware crews and espionage groups rarely walk in through the front door anymore. Phishing, stolen credentials or an unpatched edge device gets them a foothold with limited permissions. Privilege escalation bugs like these two are the next step, the one that turns a contained incident into a full domain compromise. That is why CISA treats them with the same urgency as remote code execution flaws, and why security teams should too.

What to do about it

Windows systems with automatic updates enabled will pick these fixes up on their normal cycle, but do not wait for that if you manage machines directly. Organisations running Windows Server, especially anything internet-facing or handling sensitive data, should prioritise this month's cumulative update ahead of the 22 September deadline even if you are not a federal agency bound by it. Home users should simply let Windows Update run and reboot when prompted rather than snoozing it for the third time this week.

If you are responsible for a fleet of machines, check which ones are still missing this month's update using your patch management console, and flag any device that has gone quiet, since a machine that has stopped checking in is sometimes one that is already compromised.

Takeaway: two privilege escalation bugs in Windows are already being exploited. Patch this week rather than this month, particularly on servers and anything internet-facing.