Microsoft patches two exploited Windows privilege flaws in September update

Microsoft's September 2026 Patch Tuesday, released Sept. 8, fixed two Windows privilege escalation flaws that were already being exploited, along with several hundred other vulnerabilities in what security firms described as another record-sized monthly release.

Both zero-days are local bugs: an attacker needs a foothold on the machine first. But SYSTEM-level access is what ransomware operators and other intruders look for after they get in through phishing or stolen credentials, which is why exploited elevation-of-privilege flaws tend to be patched first.

The two zero-days

• CVE-2026-81963 is an improper link resolution ("link following") flaw in the Windows Update Stack that lets an authorized local attacker elevate privileges. Help Net Security reported that it affects several Windows 11 versions and Windows Server 2025, and that Microsoft's own threat intelligence centre reported it.
• CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC). Help Net Security reported that it affects Windows 10 and Windows Server 2012 through 2022, and that researchers at Proofpoint reported it.

Microsoft scored both 7.8 on the CVSS scale. CISA added them to its Known Exploited Vulnerabilities catalog on Sept. 8 with a Sept. 22 deadline for U.S. federal agencies. Microsoft has not described the attacks.

Other notable fixes

The release also addressed a Windows DNS flaw, CVE-2026-69730, that Help Net Security described as a successor to the 2020 SigRed bug and part of a cluster of roughly 20 flaws that could be wormable. Other fixes covered a Kerberos authentication bypass on domain controllers (CVE-2026-69676), a remote code execution bug in Exchange Server triggered by a malicious Visio attachment (CVE-2026-55007), and several SharePoint Server flaws.

Counts of the total differ by tracker. Malwarebytes counted 964 CVEs, 104 of them Critical, while other outlets put the figure between 964 and 974 depending on what they included.

The Canadian Centre for Cyber Security issued advisory AV26-896 on the rollup and encouraged organizations to apply the updates.

What to do

• Deploy the September cumulative updates, starting with internet-facing servers, domain controllers and DNS servers.
• Patch Exchange and SharePoint servers that are still on premises.
• Review endpoint detection alerts for unexpected SYSTEM-level processes on workstations, since both zero-days are used after an initial compromise.