Summary
| Parameter | Value |
|---|---|
| CVE ID (lead entry) | CVE-2026-81963 |
| Vulnerabilities covered | 2 (CVE-2026-81963, CVE-2026-85880) |
| Alert source | CISA KEV - actively exploited vulnerabilities |
| CVE year | 2026 |
| Publication date | 2026-09-08 |
| Vendor | Microsoft |
| Product | Windows (client and server) |
| CVSS Score | 7.8 (High) — both |
| CISA KEV | Yes — both |
| CISA deadline | 2026-09-22 |
| Ransomware | Not confirmed |
Vulnerability Description
Microsoft’s September patch release contains two vulnerabilities that are already being exploited — both were added to the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of 22 September 2026. Both lead to local privilege escalation.
| CVE | Component | Vulnerability class | Systems affected |
|---|---|---|---|
| CVE-2026-81963 | Windows Update Stack | link following — improper link resolution before file access | Windows 11 23H2, 24H2, 25H2, 26H1; Windows Server 2025 |
| CVE-2026-85880 | Windows ALPC | heap-based buffer overflow | Windows 10 1607, 1809, 21H2, 22H2; Windows Server 2012, 2012 R2, 2016, 2019 |
Note how these two complement each other. The first affects new systems, the second old ones. In a typical organisation with a mixed fleet — new laptops on Windows 11, file servers on 2016, some legacy system on 2012 R2 — together they cover practically everything. There is no version here about which you can say “this does not affect us because our systems are new”, or “because they are old”.
What “local privilege escalation” means, and why the 7.8 score is misleading. Both vulnerabilities require the attacker to already have some access to the system: a user account, an active session, or the ability to run code with low privileges. On their own they do not open a route into the network — which is exactly why their CVSS score is 7.8 rather than 9.8.
That score, however, measures technical properties, not likelihood of use. Privilege escalation is the standard second step of any real attack: the first is phishing, a malicious attachment or stolen credentials; the second is raising privileges from an ordinary user account to system level. It is that second step which turns a single infected workstation into control over the domain — and which decides whether the incident ends with wiping one laptop or with restoring the environment from backups.
This is why, when setting patching order, presence in the KEV catalog should usually outweigh the CVSS score alone. A 7.8 flaw known to be exploited is more urgent than a 9.8 flaw with no public exploit.
Required Actions
- Install the September cumulative updates for every Windows version present in the organisation. There is no single update here — the vulnerabilities affect disjoint sets of systems, so skipping any branch of the fleet leaves one of the two flaws open.
- Start with systems used by accounts holding administrative privileges and with servers performing authentication roles. That is where the impact of escalation is greatest.
- Check Windows Server 2012 and 2012 R2. These systems are past standard support; the patch will only reach them under extended support. If the organisation does not have it, the update will not arrive and compensating controls must be planned — network segmentation, restricted interactive logons, and ultimately migration.
- Verify deployment state, not dispatch state. The update management console shows that a patch has been published; that is not the same as confirmation that it is installed and the system has been restarted. For kernel-level patches, the restart is mandatory.
- Review logs for escalation attempts. Since both vulnerabilities are being exploited, it is worth checking recent weeks for unusual child processes running with system privileges, new local accounts, or changes to administrative group membership.
Who Is Affected?
CVE-2026-81963 affects Windows 11 releases 23H2, 24H2, 25H2 and 26H1, plus Windows Server 2025.
CVE-2026-85880 affects Windows 10 releases 1607, 1809, 21H2 and 22H2, plus Windows Server 2012, 2012 R2, 2016 and 2019.
Taken together, that means every organisation running Microsoft systems — which is to say, practically every mid-size and large company. Environments with a mixed fleet are especially exposed, because it is easy to miss one branch: updating workstations without servers leaves the second flaw open, and vice versa.
Legacy systems deserve separate attention — the ones that cannot easily be updated because an older production application runs on them. Those most often remain on old releases, and those are the ones covered by CVE-2026-85880.
Sources
- NVD - CVE-2026-81963
- NVD - CVE-2026-85880
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-81963
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-85880
- Microsoft MSRC - CVE-2026-81963
- Microsoft MSRC - CVE-2026-85880
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
