Windows Zero-Days: Update Stack and ALPC EoP (Sep 2026)

What to do

1. Check the OS build on every Windows machine and compare it with the fixed build for its version.
2. Install the September 2026 or any later cumulative update (October's is fine) on stragglers, then reboot.
3. Patch Remote Desktop hosts, jump boxes and shared build agents first, since any logged-in user could become SYSTEM.
4. Find Windows machines that no longer receive monthly security updates and retire or isolate them.
5. Review EDR alerts from before patching for privilege escalation from user sessions to SYSTEM.

How to check if you are affected or compromised

• Run winver or read the UBR registry value and confirm the build is at or above the fixed build for that Windows version.
• In EDR, look for SYSTEM processes whose parent chain leads back to a normal user session, browser or Office app.
• Look for new services or scheduled tasks created shortly after a user opened a downloaded file or attachment.
• For CVE-2026-81963, look for junctions or symbolic links created by non-admin users in folders Windows Update components write to.

What happened#

On September 8, 2026, Microsoft's monthly security release fixed two Windows privilege-escalation bugs that attackers were already exploiting. CVE-2026-81963 is a link-following flaw (CWE-59) in the Windows Update Stack. CVE-2026-85880 is a heap-based buffer overflow (CWE-122) in Advanced Local Procedure Call (ALPC), the Windows mechanism processes use to message each other locally. Either one lets an attacker who already runs code with low privileges become SYSTEM. Microsoft rates both Important, scores both CVSS 3.1 7.8, and marks both "Exploitation Detected". CISA added both to the Known Exploited Vulnerabilities catalog the same day and gave federal agencies until September 22.

Microsoft has not described the attacks. Its acknowledgments credit the Microsoft Threat Intelligence Center (MSTIC) and outside researchers for the Update Stack bug, and Proofpoint researchers and Volexity for the ALPC bug. For CVE-2026-85880, Microsoft's FAQ says an attacker "who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox." That makes it a natural second stage after a browser or document exploit.

Who is affected#

According to Microsoft's update guide, the two bugs split cleanly across Windows generations. Every supported release needed one fix or the other.

• CVE-2026-81963 (Update Stack): Windows 11 23H2, 24H2, 25H2 and 26H1, and Windows Server 2025. Fixed by KB5124008 (24H2 build 26100.9445, 25H2 26200.9445), KB5122880 (23H2, 22631.7582), KB5124012 (26H1, 28000.2954) and KB5122871 (Server 2025, 26100.33438).
• CVE-2026-85880 (ALPC): Windows 10 1607, 1809, 21H2 and 22H2, and Windows Server 2012, 2012 R2, 2016, 2019 and 2022. Fixed by KB5122878 (Windows 10 21H2/22H2, 19044/19045.7725), KB5122876 (1809 and Server 2019, 17763.9245), KB5123099 (1607 and Server 2016, 14393.9512), KB5122882 (Server 2022, 20348.5622), and the monthly rollups KB5123066 (2012 R2) and KB5123065 (2012).

The CVE records define the fix by build number, so any later cumulative update, including October 2026's, also covers both bugs.

Do you really need to act?#

Yes, but this is fleet hygiene rather than an emergency, and most managed fleets finished it in September. Both bugs are local. The attacker first needs code on the machine, through phishing, a malicious download, a stolen login or another exploit. Local privilege escalation is still what turns one compromised user into full control of a host: security tools switched off, credentials dumped, lateral movement. Dustin Childs of the Zero Day Initiative told Help Net Security he doubts the automatic update process itself is compromised. He thinks the Update Stack bug is more likely paired with a code-execution bug to spread malware or ransomware. Tenable counts seven Update Stack privilege-escalation bugs patched since 2022, and this is the first exploited as a zero-day. It calls the ALPC bug the first ALPC fix on a Patch Tuesday in more than three years, and the second ALPC flaw exploited as a zero-day since CVE-2023-21674.

• Desktops and laptops, including developer workstations, are the likeliest targets, because people open files and browse on them. Confirm the update is installed.
• Multi-user servers such as Remote Desktop hosts, jump boxes and shared build agents come next. Anyone who can log in could become SYSTEM.
• Single-purpose servers with no untrusted users or files: patch on your normal cycle.
• Windows machines that no longer receive monthly security updates did not get either fix and will not.
• Linux and macOS are not affected.

What to do now#

1. Check the build. Run winver, or in PowerShell Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR, and compare with the fixed build above (for example 26100 and 9445 or higher on Windows 11 24H2).
2. Do not rely on Get-HotFix -Id KB5124008 alone. A newer cumulative update replaces the September KB, so a higher build number also counts. For fleets, use your Intune, WSUS or Configuration Manager compliance reports.
3. Install the latest cumulative update on stragglers and reboot. The fix does not take effect until the restart.
4. Do Remote Desktop hosts, jump boxes and CI agents that run untrusted code first.
5. Retire or isolate Windows hosts that are out of security support.

How to tell if you were hit#

As of Oct 21, 2026, Microsoft, Proofpoint and Volexity have not published indicators for these bugs, so there is no signature to search for. Hunt for the general pattern of local privilege escalation in EDR telemetry: SYSTEM processes whose parent chain leads back to a user session, a browser or an Office app; new services or scheduled tasks created right after a user opened a file; and, for the Update Stack bug, junctions or symbolic links created by non-admin accounts in folders that Windows Update components write to. If a host was compromised at user level before it was patched, treat it as fully compromised. Reimage it and rotate the credentials it held.

Timeline#

• Sep 8, 2026 — Microsoft releases fixes and marks both bugs as exploited. CISA adds both to KEV.
• Sep 16, 2026 — Microsoft corrects the CVSS temporal exploit-maturity setting for CVE-2026-85880 (informational change only).
• Sep 22, 2026 — CISA's remediation deadline for federal agencies.
• Oct 7, 2026 — Latest revision of the CVE-2026-81963 advisory (acknowledgment update only).

Vulnerability records

• CVE-2026-81963 · KEV 2026-09-08 · Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
• CVE-2026-85880 · KEV 2026-09-08 · Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2026-81963 Windows Update Stack Elevation of Privilege Vulnerability msrc.microsoft.com
2. Microsoft MSRC — CVE-2026-85880 Windows ALPC Elevation of Privilege Vulnerability msrc.microsoft.com
3. CVE record — CVE-2026-81963 cve.org
4. CVE record — CVE-2026-85880 cve.org
5. NVD — CVE-2026-81963 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2026-81963 cisa.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2026-85880 cisa.gov
8. Tenable — Microsoft's September 2026 Patch Tuesday addresses 964 CVEs ar.tenable.com

Coverage and analysis

1. Help Net Security — September 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor helpnetsecurity.com