Windows Zero-Days CVE-2026-85880 & CVE-2026-81963: Two SYSTEM Escalations Rated 'Important'

Microsoft's September 2026 Patch Tuesday closed 966 flaws, 105 of them critical. Two were being exploited before the patch shipped. Neither is a critical. Neither is remote code execution. Both are local elevation-of-privilege bugs that turn an existing foothold into full SYSTEM control on a Windows box — and both carry a CVSS score of 7.8, the "Important" tier that most patch programs schedule for the following maintenance window. CISA added both to the Known Exploited Vulnerabilities catalog on September 8 with a remediation deadline of September 22. The gap between how these bugs are scored and what attackers actually do with them is the whole story.

Two Windows zero-days, and neither is an RCE

Here are the two being exploited in the wild, straight from the advisories:

CVE	Component	Class	CVSS	Effect	Credited to
CVE-2026-85880	Windows Advanced Local Procedure Call (ALPC)	Heap-based buffer overflow	7.8	Local attacker escapes a low-privilege AppContainer sandbox and elevates to SYSTEM; no user interaction	Volexity; Proofpoint
CVE-2026-81963	Windows Update Stack	Link-following (improper link resolution)	7.8	Local attacker abuses symbolic-link resolution to elevate to SYSTEM	MSTIC

CVE-2026-85880 is the first ALPC vulnerability Microsoft has shipped in a Patch Tuesday in more than three years, and only the second ALPC bug exploited as a zero-day since January 2023. CVE-2026-81963 is the first of seven Windows Update Stack elevation bugs patched since 2022 to be caught in active exploitation. The credit lines matter: Volexity and MSTIC are the names you see attached to targeted intrusion work, not to commodity crimeware. Somebody burned two fresh Windows zero-days to escalate privileges, quietly, against chosen targets.

The month's shape reinforces the point. Of the 966 flaws, 438 were elevation-of-privilege and 258 were remote code execution — EoP outnumbered RCE nearly two to one. The two that were actually being exploited came from the larger, quieter pile.

Why attackers burn zero-days on privilege escalation

The instinct to treat a 7.8 local bug as second-tier comes from a mental model where the remote, pre-auth RCE is the prize and everything else is housekeeping. That model is a decade out of date.

Initial access is cheap now. A phishing lure with a signed loader, a stolen session cookie bought from a stealer log, a single reused credential against an exposed VPN, a poisoned npm package pulled into a developer's laptop — any one of these lands an attacker inside as a normal user. What they get is code execution at low or medium integrity: useful, but boxed in. They can't read other users' secrets, can't touch LSASS, can't disable the EDR agent, can't install a service that survives reboot. The privilege boundary is the only thing standing between "a compromised user account" and "a compromised machine."

That boundary is exactly what CVE-2026-85880 and CVE-2026-81963 erase. Both require local access; both require low privileges; both need no user interaction; both hand the attacker SYSTEM. SYSTEM is where the intrusion becomes real: credential theft, persistence, tampering with logs, moving laterally with the machine account.

"We're fine on the two zero-days — they're only 7.8, local access required."

The phishing payload that ran on a sales laptop this morning is the local access. The 7.8 is the part of the breach that happens next.

This is why mature intrusion sets pay for EoP zero-days specifically. A remote RCE gets you one box; an escalation primitive that works against every patched Windows machine in the estate gets you all of them, from any foothold, reliably, for as long as it stays unpatched. It is the reusable half of the kill chain.

CVSS says "Important." Your kill chain says "critical."

CVSS base scores penalise heavily for an attack vector of "Local" and a privileges-required of "Low." That math is how a bug that gives an attacker SYSTEM lands at 7.8 instead of 9-point-something. The scoring is internally consistent; it is also systematically wrong about operational risk, because it models the precondition — "attacker already has local code execution" — as a discount. In a real intrusion that precondition is not a discount. It is Tuesday.

A few things follow from that:

• The severity filter hides the exploited bugs. A patch program that defers everything below CVSS 9.0 would have deferred both of this month's actively exploited zero-days. The bugs being used against real targets were sitting in the "Important, next window" bucket.
• ALPC elevation is a recurring surface, not a fluke. Zero Hunt's own knowledge base returns a long line of ALPC elevation-of-privilege entries — CVE-2022-41093, CVE-2022-41045, CVE-2022-41100, CVE-2022-30160, CVE-2022-30202, CVE-2023-28216 among them. This class comes back to Patch Tuesday on a schedule. Treating each new instance as a surprise is a planning failure, not a detection one.
• Link-following (the Update Stack bug) is a decades-old primitive. Improper symbolic-link resolution in a privileged service lets a low-privilege user redirect a SYSTEM-context file operation to a target it was never meant to touch. It is unglamorous and it works, which is why it keeps shipping in updaters, installers, and backup agents.

The defensive question is not "how critical is this CVE?" It is "if an attacker is already running as a user on this host, what can they reach?" CVSS cannot answer that. Only running the chain can.

Remediation

Treat both as priority patches, not maintenance-window items. The CISA KEV deadline of September 22 is the federal floor, not the security-driven target — these were exploited as zero-days before the fix existed.

1. Am I affected? Both bugs are in core Windows components, so every supported client and server build is in scope until patched. CVE-2026-81963 reaches current Windows 11 and Windows Server 2025; CVE-2026-85880 also reaches older Windows 10 and Server branches — check your legacy fleet, not just the new images. Confirm the September 8, 2026 cumulative is installed:

# Is the September cumulative present?
Get-HotFix -Id KB5124008, KB5122880, KB5122878 -ErrorAction SilentlyContinue
# Or read the build and compare to the patched revision for your SKU
[System.Environment]::OSVersion.Version
winver

2. Patch — exact fixed updates. Apply the September 8, 2026 security updates: KB5124008 and KB5122880 for Windows 11, KB5122878 for Windows 10 (ESU). Server SKUs take their corresponding September cumulative. Both CVEs are fixed in the single monthly rollup; there is no separate hotfix to track.

3. Can't patch immediately? Compensating controls. You cannot meaningfully mitigate a local EoP in a core OS component with configuration — the real control is to starve the precondition (local code execution) and blunt the payoff (what SYSTEM buys the attacker):

• Put EDR in block mode and enable Attack Surface Reduction rules; the EoP only fires after something lands a foothold.
• Enforce application allowlisting (WDAC/AppLocker) and block the usual initial-access LOLBins and macro paths.
• Enable LSASS protection (RunAsPPL) and Credential Guard so a SYSTEM escalation does not immediately yield domain credentials.
• Remove standing local-administrator rights and restrict interactive logon on servers.
• Prioritise patching internet-facing and high-value hosts, where a foothold is most likely and most expensive.

4. Hunt for compromise. Because exploitation leaves little on disk, hunt on behaviour and on what happens after the escalation. Map to MITRE ATT&CK:

• T1068 — Exploitation for Privilege Escalation: a low/medium-integrity or AppContainer process immediately followed by SYSTEM-integrity activity from the same lineage (Sysmon Event ID 1, parent/child and integrity-level anomalies). Repeated svchost.exe/lsass.exe crashes with WER reports can indicate failed ALPC exploitation attempts.
• Link-following (CVE-2026-81963): reparse-point / symbolic-link or junction creation under Windows Update working directories by a non-TrustedInstaller process (Sysmon Event ID 11), and TrustedInstaller-context writes to attacker-controllable paths.
• T1134 — Access Token Manipulation and T1003.001 — LSASS Memory: non-security-tool processes opening a handle to lsass.exe (Sysmon Event ID 10) shortly after an integrity jump.
• T1543.003 — Windows Service and T1547: new services or run keys created in the same session (System Event ID 7045).
• T1070.001 — Clear Windows Event Logs: Security log clears (Event ID 1102) immediately after the escalation window — a reliable tell that something reached SYSTEM.

5. Eradicate and verify. On any host that shows post-escalation signals, assume SYSTEM was reached: isolate, pull a triage image, and rotate every credential that touched the box — local accounts, cached domain creds, service accounts, and the machine account itself (which an attacker at SYSTEM can use for authenticated lateral movement). Reimage rather than clean when persistence as SYSTEM is suspected. Verify by confirming the cumulative is installed and that the post-escalation ATT&CK signals above have gone quiet across the fleet, not just on the one host you found.

Where Zero Hunt fits: proving the second half of the chain

Everything above comes down to one question a CVSS score cannot answer: from a realistic foothold, what does this actually reach? That is a question you resolve by running the chain, not by reading the advisory — which is precisely what Zero Hunt's AI Generative Pentest is built to do.

The 10-agent swarm does not stop at finding an exposed service. Its Post-Exploit and Pivot agents take a foothold — the phishing-grade initial access this whole article assumes — and attempt the escalation-to-SYSTEM and lateral-movement steps end to end, against your hosts, with exploit code the local LLM writes per target rather than pulling a public PoC. When a local EoP like CVE-2026-85880 is reachable from a realistic starting point on a specific machine, the engine surfaces it as a validated chain — foothold → SYSTEM → what came next — not as a line item scored 7.8 and deferred. Every skill is backtested in the AI Gym before it touches production, and every action is ECDSA-signed into a chain-of-custody record, so the finding is a reproducible, defensible account of what the attacker path really was.

And the steps after SYSTEM — the credential theft, the machine-account lateral movement, the new service beaconing out — are exactly what the AI Traffic Analysis model reads on the wire, while they happen, with no agent to disable on the host the attacker now owns. A local EoP is invisible until someone runs it forward. Run it forward on purpose, before the people burning zero-days do it for you.