Microsoft's 974-fix update includes two exploited Windows flaws
Microsoft's September Patch Tuesday fixes 974 vulnerabilities, including two Windows zero-days the company says are being exploited in the wild. Both flaws allow local privilege escalation, meaning an attacker with code running on a host can gain higher privileges.
CVE-2026-85880 affects Windows Advanced Local Procedure Call (ALPC), a system communication mechanism. Code already running inside Windows' AppContainer sandbox can exploit it to escape the sandbox and gain SYSTEM privileges, without another user click. CVE-2026-81963 affects the Windows Update Stack and also lets an authorized local attacker gain SYSTEM privileges.
For Windows estates working through the release in bulk, these two fixes carry a distinct exposure: a low-privilege foothold can become SYSTEM-level control. Microsoft has not said who was targeted or whether any attacks succeeded.
CVSS 7.8 HIGH: improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker… Microsoft patch: 5122871.
Microsoft Releases September 2026 Security Updates
JPCERT-AT-2026-0025 JPCERT/CC 2026-09-09 Microsoft Corporation September 2026 Security Updates https://msrc.microsoft.com/update-guide/en-US/releaseNote/2026-Sep According to Microsoft, among the vulnerabilities, the following vulnerability has been confirmed to be exploited in…
Microsoft discloses two actively exploited zero-days among 974 vulnerabilities
While the vendor hit another monthly record, it hasn’t resulted in a flood of active exploits. Researchers encourage customers to focus on their specific areas of risk and exposure.