Two Local Privilege Escalations Outranked the Remote Bugs: How to Read the September 2026 Microsoft Patch Wave

Microsoft's September 2026 security release is the largest on record by CVE count. Public tallies put the total at 974 CVEs, with roughly 723 affecting Windows, 222 affecting Office, and the remainder spread across SQL Server, SharePoint, Exchange Server, Azure services and developer tooling. Different trackers report slightly different totals depending on whether third-party CVEs bundled into the release are included.

The number is the least useful part of the release. What matters is that two of those CVEs were being exploited before the patch shipped, and both are local privilege escalation flaws rather than the remote code execution bugs that usually attract attention first.

The two exploited zero-days

CVE-2026-81963 is a link-following and improper access control flaw in the Windows Update Stack. The update stack resolves file paths when applying updates, and the vulnerable code followed links it should not have followed. A local attacker with low privileges can use a malicious symbolic link to cause a system file to be overwritten, and because the update service runs with SYSTEM privileges, the result is elevation to SYSTEM.

This is the seventh privilege escalation issue in the Windows Update Stack since 2022, and the first of them to be both a zero-day and confirmed exploited in the wild. The position of the component is what makes it notable: the update stack is the mechanism that delivers patches. An attacker who can influence it is working against the process defenders rely on to fix everything else.

CVE-2026-85880 is a heap buffer overflow in the Windows Advanced Local Procedure Call (ALPC) component, also rated CVSS 7.8. ALPC is the internal inter-process communication mechanism Windows uses extensively. The reported exploitation path involves code running in a low-privilege AppContainer escaping the sandbox and reaching SYSTEM. This is the first ALPC fix from Microsoft since April 2023, and the second zero-day in the component in roughly four years.

Both were added to CISA's Known Exploited Vulnerabilities catalog on 8 September 2026, with a federal remediation deadline of 22 September 2026.

Why the low CVSS is misleading here

A common triage shortcut ranks remote, unauthenticated vulnerabilities above local privilege escalation. The September release contains a large number of CVSS 9.8 remote code execution flaws in Windows components including the DNS Server, Remote Desktop Services, the NFS ONCRPC XDR driver, Netlogon, the DHCP Server, the Routing and Remote Access Service, SSTP, and the print spooler path. Several of them are pre-authentication and require no user interaction.

Those deserve attention. But the two zero-days sit in a different category of risk, for a specific reason.

Local privilege escalation is a post-compromise capability. It does not get an attacker in; it determines what they can do after they are in. A phishing payload, a compromised service account, or an exploited browser bug gets an initial foothold. A reliable SYSTEM escalation converts that foothold into full control of the host, and from there into credential material and lateral movement.

When an escalation is already being exploited in the wild, the practical question is not "how likely is exploitation" but "how many of our endpoints already have an attacker on them." The patch closes the escalation path; it does not remove an attacker who used it before the patch was applied.

A triage order for this release

First, the two KEV entries. Deploy the September cumulative update to endpoints and servers, prioritising systems where a low-privilege user or a sandboxed process could realistically run attacker-controlled code. That includes user workstations, multi-tenant application servers, and any host running containers or sandboxed workloads.

Second, internet-reachable pre-authentication RCE. The DNS Server, RDP, Netlogon, DHCP, RRAS and SSTP flaws are reachable from the network in common configurations. Servers exposing those services should be patched in the same window, not deferred to a later cycle.

Third, assume compromise where the escalation could have been used. For hosts that were unpatched while CVE-2026-81963 or CVE-2026-85880 were exploitable, review for the artefacts of privilege escalation: unexpected services, new local administrator accounts, scheduled tasks created outside change control, and process trees in which a SYSTEM-level process was spawned by a low-privilege parent.

Fourth, the volume. With hundreds of CVEs in one release, a full inventory-driven sweep will take time. Ranking by reachability and by exploitation status keeps the first wave manageable and defensible.

The takeaway for prioritisation models

Scoring systems that weight network reachability heavily will consistently under-rank local privilege escalation. That is a modelling choice, not a statement about risk. In a month where two local escalations were exploited and dozens of remote bugs were not, the model and the threat disagreed.

The practical adjustment is to treat "exploited in the wild" as a primary sort key, ahead of CVSS, and to treat privilege escalation in a core operating system component as a high-severity finding regardless of its score. The September 2026 release is a clean example of why.

References

• Microsoft Security Response Center advisories for CVE-2026-81963 and CVE-2026-85880.
• CISA Known Exploited Vulnerabilities catalog entries added 8 September 2026, federal deadline 22 September 2026.
• Public patch-day analyses covering the September 2026 release volume and component breakdown.