Full Report
While the vendor hit another monthly record, it hasn’t resulted in a flood of active exploits. Researchers encourage customers to focus on their specific areas of risk and exposure. The post Microsoft discloses two actively exploited zero-days among 974 vulnerabilities appeared first on CyberScoop.
Analysis Summary
# Vulnerability: September 2026 Microsoft Privilege Escalation Zero-Days
## CVE Details
- **CVE ID:** CVE-2026-81963 and CVE-2026-85880
- **CVSS Score:** 7.8 (High)
- **CWE:** Elevation of Privilege (Specific CWE not provided in text, typically CWE-269)
## Affected Systems
- **Products:**
- Windows Update Stack (CVE-2026-81963)
- Windows Advanced Local Procedure Call / ALPC (CVE-2026-85880)
- **Versions:** Multiple versions of Windows OS (part of a broader release affecting Windows, Office, SQL Server, and developer tools).
- **Configurations:** Systems running standard Windows configurations where these core components are active.
## Vulnerability Description
These vulnerabilities are Elevation of Privilege (EoP) flaws. CVE-2026-81963 resides within the Windows Update Stack, while CVE-2026-85880 resides within the Advanced Local Procedure Call (ALPC) mechanism. Both flaws allow an attacker with limited access to a system to gain elevated permissions, potentially reaching SYSTEM-level privileges, which would allow for full control over the affected machine.
## Exploitation
- **Status:** **Exploited in the wild** (Both identified as zero-days prior to disclosure).
- **Complexity:** Not explicitly stated, though typical for EoP zero-days of this CVSS.
- **Attack Vector:** Local (Exploitation generally requires the attacker to already have a footprint on the target system to escalate privileges).
## Impact
- **Confidentiality:** High (Ability to access restricted data via elevated privileges).
- **Integrity:** High (Ability to modify system files and configurations).
- **Availability:** High (Ability to disrupt system services or lock out users).
## Remediation
### Patches
- Microsoft has released security updates for all 974 vulnerabilities as part of the September 2026 Patch Tuesday release. Users should apply updates via Windows Update or the Microsoft Security Response Center.
### Workarounds
- No specific workarounds were provided in the article; immediate patching is the recommended course of action for actively exploited flaws.
## Detection
- **Indicators of Compromise:** Monitor for unusual account activity, unauthorized changes to system-level permissions, or unexpected processes originating from the Windows Update Stack or ALPC calls.
- **Detection methods and tools:** EDR (Endpoint Detection and Response) tools should be configured to flag anomalous privilege escalation attempts. Organizations are encouraged to use vulnerability scanners to identify unpatched assets.
## References
- **Vendor Advisories:** [https://msrc.microsoft.com/update-guide/releaseNote/2026-Sep](https://msrc.microsoft.com/update-guide/releaseNote/2026-Sep)
- **CVE-2026-81963 Advisory:** [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963)
- **CVE-2026-85880 Advisory:** [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880)
- **Researcher Analysis:** [https://www.zerodayinitiative.com/blog/2026/9/8/the-september-2026-security-update-review](https://www.zerodayinitiative.com/blog/2026/9/8/the-september-2026-security-update-review)