# Microsoft just patched two Windows flaws attackers were already using

> September's Patch Tuesday fixed 973 vulnerabilities, including two Windows zero-days already exploited in the wild, with a CISA deadline of 22 September.

- Published: 2026-09-11
- Topic: [Security](https://futuretechnologyhq.com/topic/security/)
- URL: https://futuretechnologyhq.com/article/microsoft-patch-tuesday-september-2026-two-zero-days/
- Publisher: [Future Technology](https://futuretechnologyhq.com/), free to read. Quote as "Future Technology" with a link to the article.

## Key points

- Patch Windows this week, especially servers and internet-facing machines
- Privilege escalation bugs matter as much as remote code execution flaws
- CISA federal deadline is 22 September 2026

## Article

## What did Microsoft patch in September 2026?

Microsoft's September 2026 Patch Tuesday shipped 973 fixes, one of the largest batches the company has released. Two of them matter more than the rest combined, because attackers were already exploiting both vulnerabilities before a patch existed. Security teams call that kind of bug a zero-day, since the vendor has had zero days to prepare a fix when the attacks begin.

CVE-2026-85880 sits in the Windows Advanced Local Procedure Call component and lets an attacker who already has a foothold on a machine escalate to higher privileges. CVE-2026-81963 does something similar through the Windows Update Stack, handing attackers SYSTEM level access once they are in. SYSTEM is the highest privilege level on a Windows machine, above even an administrator account.

Neither is a way to break in from the outside. Both are the tool an attacker reaches for once they are already inside, turning a low-level compromise into full control of the machine.

## The two zero-days at a glance

| | CVE-2026-85880 | CVE-2026-81963 |
|---|---|---|
| Affected component | Windows Advanced Local Procedure Call | Windows Update Stack |
| What it does | Escalates privileges for an attacker already on the machine | Gives SYSTEM level access once the attacker is in |
| CVSS score | 7.8 | 7.8 |
| Exploited before a patch | Yes | Yes |
| On the CISA KEV catalogue | Yes | Yes |
| Federal patch deadline | 22 September 2026, 23:59 EDT | 22 September 2026, 23:59 EDT |

## Why does a CVSS score of 7.8 understate the risk?

Both bugs carry a CVSS score of 7.8. CVSS, the Common Vulnerability Scoring System, rates how severe a flaw is on a scale up to 10, and a 7.8 sounds moderate next to some of the critical remote code execution bugs in the same batch. Remote code execution means an attacker can run their own commands on a target machine from elsewhere, which is why those flaws tend to grab the headlines.

Severity scores measure the wrong thing here. A score describes how bad a flaw could be in the abstract. It says nothing about whether anyone is using it right now, and these two are being used.

What matters is that CISA, the US Cybersecurity and Infrastructure Security Agency, has already added both to its Known Exploited Vulnerabilities catalogue. That listing confirms active use against real targets. Federal civilian agencies in the US have until 22 September 2026, 23:59 EDT, to patch.

## Why privilege escalation bugs are the quiet danger

Ransomware crews and espionage groups rarely walk in through the front door anymore. Phishing, stolen credentials or an unpatched edge device gets them a foothold with limited permissions. At that point they can usually read some files and run some programs, but they cannot switch off security tools, dump stored passwords or move freely across a network.

Privilege escalation bugs like these two are the next step. They are the move that turns a contained incident into a full domain compromise, meaning the attacker controls the central system that decides who may log in to everything else. That is why CISA treats them with the same urgency as remote code execution flaws, and why security teams should too.

The pattern is familiar. Attackers chain a cheap way in with a reliable way up. We covered one example of that approach in [Chinese hackers chaining Chrome and Windows zero-days for weeks](/article/chrome-windows-chained-zero-day-chinese-apt/), where a browser bug supplied the entry point and a Windows bug supplied the extra privileges.

## Why are the ALPC and Windows Update components attractive targets?

Both components run deep inside the operating system with high privileges. The Advanced Local Procedure Call component is the mechanism Windows uses to let programs and system services pass messages to one another on the same machine. The Windows Update Stack is the machinery that downloads and installs updates, and it has to be trusted to change protected parts of the system.

Software that runs with that much trust is a natural place to look for mistakes. If an attacker can make a privileged component do something it was never meant to do, they borrow its authority. That is the general shape of a local privilege escalation, and it explains why such bugs keep turning up in core Windows components.

It also explains why the attacker needs a foothold first. Because both flaws are local, they cannot be triggered from across the internet on their own. They only pay off after something else has already gone wrong, such as a successful phishing email or a stolen password.

## How do these flaws fit with the rest of the month's exploited bugs?

These are not the only exploited flaws in circulation. Our report on [ten actively exploited CVEs landing before September's Patch Tuesday](/article/actively-exploited-cve-september-2026/) shows how crowded the list of bugs under active attack already was. Another Windows example is [CVE-2026-73009 in the Windows SSTP service](/article/cve-2026-73009-sstp-windows-vulnerability/), which needs no password.

The wider direction of travel is toward shorter patch windows. [CISA cut the patch window to three days](/article/cisa-three-day-patch-window/) for some flaws, a sign of how quickly attackers move once a bug is known. A fix that sat in a queue for weeks a few years ago is now expected to land far faster.

Windows has also seen security tooling itself targeted. The [BlueHammer flaw in Windows Defender](/bluehammer-defender-flaw/) was reportedly being used by ransomware gangs, which is a reminder that the defences on a machine can become part of the attack surface.

## What to do about it

Windows systems with automatic updates enabled will pick these fixes up on their normal cycle, but do not wait for that if you manage machines directly. Organisations running Windows Server, especially anything internet-facing or handling sensitive data, should prioritise this month's cumulative update ahead of the 22 September deadline even if you are not a federal agency bound by it.

Home users should simply let Windows Update run and reboot when prompted rather than snoozing it for the third time this week. The fix is not active until the restart, so a pending reboot means the machine is still exposed.

If you are responsible for a fleet of machines, check which ones are still missing this month's update using your patch management console. Flag any device that has gone quiet, since a machine that has stopped checking in is sometimes one that is already compromised.

### A short checklist for administrators

- Confirm the September 2026 cumulative update is installed on servers first, then on workstations.
- Treat internet-facing machines and anything holding sensitive data as the highest priority.
- List devices that have not reported to your patch management console recently and investigate them.
- Review how accounts get their privileges, since limiting what an attacker can reach after a foothold reduces the damage these bugs can do.
- Keep watching the CISA Known Exploited Vulnerabilities catalogue, because additions to it signal which bugs to patch next.

## What happens next?

Federal civilian agencies must patch by 22 September 2026, and other organisations are likely to follow the same timetable as a sensible benchmark. After a zero-day is disclosed, attackers who were using it quietly often keep going against anyone who has not updated, so the risk does not end when the patch ships. It ends when the patch is installed.

Two privilege escalation bugs in Windows are already being exploited. Patch this week rather than this month, particularly on servers and anything internet-facing.

## Key takeaways

- Microsoft's September 2026 Patch Tuesday included 973 fixes, with two vulnerabilities being exploited by attackers before a patch existed.
- CVE-2026-85880 and CVE-2026-81963 allow attackers to escalate privileges, with the latter granting SYSTEM level access through the Windows Update Stack.
- Both vulnerabilities have a CVSS score of 7.8 and have been added to the CISA Known Exploited Vulnerabilities catalogue.
- Privilege escalation bugs like these are a significant threat, as they can turn a contained incident into a full domain compromise.
- Organisations should prioritise this month's cumulative update, especially those running Windows Server, and patch by the 22 September 2026 deadline.

## Sources

- [Tenable](https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880)
- [Ivanti](https://www.ivanti.com/blog/september-2026-patch-tuesday)
- [CrowdStrike](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-september-2026/)