Windows CVE-2026-81963 and CVE-2026-85880: Two Exploited SYSTEM Privilege Escalation Flaws

1. Basic Information

• Article Title: Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
• Publisher: BleepingComputer
• Publication Date: 2026-09-08
• Original Source: BleepingComputer
• Related Sources: MSRC CVE-2026-81963, MSRC CVE-2026-85880, CISA KEV Catalog
• Related Malware, Groups, CVEs, and Products: CVE-2026-81963, CVE-2026-85880, Windows Update Stack, Windows Advanced Local Procedure Call (ALPC), Microsoft Windows
• Priority: Critical

2. Executive Summary

Microsoft patched improper file-link resolution in Windows Update Stack and a heap buffer overflow in Windows ALPC, both exploited in the wild. Each allows an attacker with local access to escalate to SYSTEM.

3. Attack Flow

Windows CVE-2026-81963 and CVE-2026-85880: Two exploited SYSTEM privilege escalation flaws

1. An attacker obtains low-privilege code execution on Windows through a separate route, such as phishing, malware, or stolen credentials. The actual initial entry path has not been disclosed.
2. The attacker locally exploits file-link resolution in Update Stack for CVE-2026-81963 or the ALPC heap buffer overflow for CVE-2026-85880.
3. The vulnerability yields a SYSTEM token or equivalent elevated execution.
4. Inference: Obtaining SYSTEM could enable disabling defenses, stealing credentials, establishing persistence, or moving laterally. Actual follow-on activity has not been disclosed.

4. Attacker Position and Execution Environment

• An attacker with low-privilege local access to the affected Windows system. These flaws alone do not provide entry for an unauthenticated external attacker.

5. What Users and Administrators May See

Users

• These vulnerabilities alone do not remotely compromise a user merely because they open a link. The interaction requirements for initial access are unknown.

Administrators

• Inference: Where endpoint auditing or EDR is available, anomalous elevation from a low-privilege process to SYSTEM and subsequent service creation can provide leads.

6. Success Conditions and Risk Reduction

Success Conditions

• The affected Windows build has not received the September 2026 updates.
• The attacker can execute low-privilege code on the endpoint.
• Endpoint controls do not stop the resulting SYSTEM process or follow-on activity.

Failure Conditions and Risk Reduction

• Deploy the September 2026 Windows security updates and verify that systems have restarted and are running the updated build.
• Use application control, least privilege, and credential protection to limit local footholds and subsequent SYSTEM abuse.
• Investigate process paths from low privilege to SYSTEM, new services or tasks, and credential access on endpoints before and after patching.

7. Potential Impact

• Code execution as SYSTEM.
• Disabling defenses, credential dumping, and persistence.
• Lateral movement and data theft using domain or cloud credentials.

8. Observable Logs

Inference: These are investigation sources and their collection requirements.

• Email: Where relevant emails exist, preserve the original messages, complete URLs, and delivery records.
• Proxy/SWG/DNS: Investigate URLs and name resolution associated with initial access or subsequent downloads. These logs cannot establish process privileges or tokens.
• Endpoint/EDR: Use endpoint auditing and EDR to investigate process creation and privileges, service/task creation, and file-link operations. A crash demonstrates a failure, not successful exploitation.
• Identity/IdP: Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval.
• SaaS/Cloud: For cloud deployments, review audit records for workloads, IAM, and API operations.
• Network: Review destinations of endpoint SMB, RDP, and similar connections, and correlate them with endpoint execution records.

9. Assessing Attack Success

The following are evidence criteria for an individual investigation. See Facts and Unknowns for the scope of actual observations.

• Attempt observed (success unconfirmed): Evidence criterion: Confirm an exploitation attempt or related abnormal termination on the endpoint.
• User interaction confirmed: Evidence criterion: Use separate evidence to establish whether initial access involved user interaction.
• Initial execution confirmed: Evidence criterion: Confirm execution of an exploit process in a low-privilege context.
• Malware execution or authentication success confirmed: Evidence criterion: Confirm acquisition of a SYSTEM token or process.
• Data theft or session compromise confirmed: Evidence criterion: Confirm unauthorized retrieval or exfiltration of credentials or data. An access attempt or preparation to send data is not completed theft.
• Follow-on compromise confirmed: Evidence criterion: Confirm persistence, defense evasion, or lateral movement.

10. Investigation Playbook

Inference: Operational recommendations based on publicly described behavior.

• Trigger: Suspicious acquisition of SYSTEM privileges, or associated process/file operations.
• Initial Checks: Identify the affected host, user, and time, and preserve relevant logs and configuration. For vulnerability incidents, verify the actual version and exposure.
• Endpoint: Use endpoint auditing and EDR to investigate process creation and privileges, service/task creation, and file-link operations. A crash demonstrates a failure, not successful exploitation.
• Identity and Cloud: Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval. For cloud deployments, review audit records for workloads, IAM, and API operations.
• Follow-on Activity: Review destinations of endpoint SMB, RDP, and similar connections, and correlate them with endpoint execution records.
• Containment: Isolate and preserve endpoints suspected of execution or theft, and revoke credentials according to the confirmed impact. Patching alone does not complete incident response.
• Classification: These success criteria are for investigations. Distinguish evidence confirmed in the individual environment from publicly reported observations.

11. Defense and Detection Ideas

Inference: Operational recommendations based on publicly described behavior.

• Single Event: Suspicious acquisition of SYSTEM privileges, or associated process/file operations.
• Time-Series Correlation: On the same endpoint, correlate low-privilege execution before exploitation, acquisition of SYSTEM privileges, and subsequent authentication or service activity.
• Threat Hunting: Investigate URLs and name resolution associated with initial access or subsequent downloads. These logs cannot establish process privileges or tokens. Review destinations of endpoint SMB, RDP, and similar connections, and correlate them with endpoint execution records.
• Logging Gaps: Check retention periods and collection settings. DNS alone does not reveal URL paths, and ordinary network logs do not reveal endpoint-local activity. Missing records do not prove an absence of compromise.
• Priority Controls: Deploy the September 2026 Windows security updates and verify that systems have restarted and are running the updated build.

12. Facts / Inference / Hypothesis

Facts

• Microsoft’s September 2026 security updates fixed CVE-2026-81963 and CVE-2026-85880, both identified as exploited in the wild.
• CVE-2026-81963 involves Windows Update Stack improperly resolving or following links before file access, allowing an attacker with local access to escalate to SYSTEM.
• CVE-2026-85880 is a heap buffer overflow in Windows ALPC that allows an attacker with local access to escalate to SYSTEM.
• Both have a CVSS v3.1 base score of 7.8. They require pre-existing local code execution or access with local privileges, rather than remote unauthenticated exploitation.
• Microsoft has not disclosed exploitation methods, scale, malware, or IOCs. CISA added both CVEs to KEV on September 8, 2026.

Inference

• The investigation, detection, and mitigation recommendations are based on publicly described behavior. Their applicability depends on each environment’s collection settings, privileges, and traffic visibility.

Hypothesis

No additional hypotheses. Unresolved points are listed under Unknowns and Further Investigation.

13. MITRE ATT&CK Mapping

• T1068 Exploitation for Privilege Escalation (high confidence): The local vulnerabilities have been exploited in the wild to escalate to SYSTEM.

14. Unknowns and Further Investigation

• Initial access, exploitation paths, targeted industries, and scale of the observed attacks.
• Reliable IOCs, exploit process names, and artifacts.
• Whether the two CVEs were used in the same campaign or separate campaigns.

15. Impact on SOCs and Organizations

SOCs should not lower priority based on CVSS alone: KEV inclusion and the ability to reach SYSTEM justify urgent updates. Because these vulnerabilities do not themselves provide remote initial access, investigate preceding low-privilege execution, credential access, and follow-on SYSTEM activity alongside patching.

16. Audience Summaries

• SOC: On the same endpoint, correlate low-privilege execution before exploitation, acquisition of SYSTEM privileges, and subsequent authentication or service activity.
• Administrators: Deploy the September 2026 Windows security updates and verify that systems have restarted and are running the updated build.
• Users: These vulnerabilities alone do not remotely compromise a user merely because they open a link. The interaction requirements for initial access are unknown.