The Exploited Zero-Day Had No CVSS Score: Reading the September 2026 Patch Tuesday by Exploitation, Not Severity

Microsoft's September 2026 Patch Tuesday is the largest on record. Vendors tracking the release count between 964 and 974 Microsoft CVEs, with roughly 104 to 113 rated Critical and the remainder Important. Two of the fixed flaws were already being exploited in the wild: CVE-2026-85880 in Windows Advanced Local Procedure Call and CVE-2026-81963 in the Windows Update Stack.

Both carry a CVSS score of 7.8 and a severity label of Important. Neither is Critical. That mismatch is the most useful thing to take from this release.

What the two exploited flaws are

CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call. An attacker who already has code execution inside a low-privilege AppContainer can escalate to SYSTEM. No user interaction is required, but the attacker needs a foothold first. Microsoft rates it Important at 7.8.

CVE-2026-81963 is an improper link resolution flaw in the Windows Update Stack, also rated Important at 7.8. It lets an authorized attacker elevate to SYSTEM locally. Microsoft has fixed seven privilege escalation flaws in the Windows Update stack since 2022. This is the first one that became a zero-day and the first exploited in the wild.

CISA added both to the Known Exploited Vulnerabilities catalog on 8 September 2026, with a federal remediation deadline of 22 September 2026.

Why the label and the score diverge

CVSS measures the technical characteristics of a vulnerability in isolation. It answers how hard the flaw is to reach and what happens when it is triggered. It does not answer whether anyone is using it.

Both flaws require local access or an existing foothold. That constraint lowers the base score. It does not lower the operational risk for an organization that already has an intrusion in progress, because privilege escalation is the step that turns a limited foothold into full control of the host. Attackers pair a low-severity elevation flaw with an initial access vector and the combination is what causes damage.

Severity labels also reflect vendor scoring policy, not attacker interest. A 7.8 that Microsoft knows is being exploited deserves more attention than a 9.8 that nobody has touched. Ranking by score alone inverts that.

The rest of the release still matters

The September release also contains a large number of high-severity remote code execution flaws in services that face the network. Windows DNS Server, Remote Desktop Services, the DHCP Server, Windows Shell, the RRAS service and the NFS ONCRPC XDR driver all received 9.8-rated pre-authentication RCE fixes. Exchange Server received an unauthenticated RCE that triggers when the server processes a message carrying a crafted Visio attachment, without the recipient opening anything.

Researchers at ZDI assessed that at least 20 of the month's flaws meet the pattern of pre-authentication, zero-interaction remote code execution, which is the combination that makes worm-like propagation possible. Those deserve their own triage track, separate from the exploited zero-days.

A triage order that survives contact with reality

Start with the two exploited flaws. They are being used now, the federal deadline has passed, and the fix is a standard cumulative update. For Windows 11 24H2 and 25H2, the September cumulative update is KB5124008, bringing builds to 26100.9445 and 26200.9445.

Next, handle the pre-authentication network RCE flaws on services that are actually reachable. A DNS Server or RDP fix on an internal-only host can wait behind a fix on a host that answers from the internet. The ZDI wormability list is a reasonable starting filter, but it should be intersected with your own exposure data rather than applied wholesale.

Then work through the elevation-of-privilege backlog, because that is where an existing intrusion becomes a full compromise. This is the category that severity-only triage systematically defers.

Finally, record why each decision was made. When the next release brings another thousand CVEs, the reasoning behind the previous month's order is what lets a team move quickly without re-litigating every item.

References

• Microsoft Security Update Guide, September 2026 cumulative updates, including KB5124008.
• CISA Known Exploited Vulnerabilities catalog entries for CVE-2026-85880 and CVE-2026-81963, added 8 September 2026.
• NVD entries for CVE-2026-85880 and CVE-2026-81963, both CVSS 7.8.
• Vendor Patch Tuesday analyses from Tenable, Arctic Wolf and Absolute, September 2026.