Actively exploited Windows Update Stack flaw anchors Microsoft's record 974-CVE Patch Tuesday

A record release with two live exploits

Microsoft's September 2026 Patch Tuesday is the largest monthly security rollout the company has shipped: 974 CVEs fixed across Windows, Office, Azure, Exchange, SharePoint and SQL Server. According to a dev.to analysis of the release, two of those vulnerabilities were already being exploited when the patches went out, and one of them sits inside the Windows Update Stack, the component that distributes patches to Windows machines in the first place.

That placement is why CVE-2026-81963 matters more than its CVSS 7.8 rating implies. A bug in the patching mechanism means an attacker can go after machines that are fully up to date, because the system meant to keep them current is itself the attack surface.

What the Update Stack flaw does

CVE-2026-81963 is a local privilege escalation that combines two weakness classes: improper link resolution before file access (CWE-59) and improper access control. The Windows Update Stack resolves file paths without properly validating links, so an attacker who already holds local, low-privileged access can trick the stack into following a link it should not. Successful exploitation yields SYSTEM privileges, and no user interaction is required.

The prerequisite of local low-privileged access is what keeps the score at 7.8 rather than critical. But as the dev.to write-up notes, citing Tenable, this is the seventh privilege escalation flaw found in the Windows Update Stack since 2022, and the first that was both a zero-day and confirmed as exploited in the wild. The previous six never saw active exploitation.

Rapid7's read of the patch, also cited in the write-up, describes the fix as tightening controls so the update stack no longer follows malicious links and cannot be tricked into letting an attacker-controlled file overwrite a system component.

The second zero-day: ALPC

The other exploited flaw, CVE-2026-85880, is a heap buffer overflow in Windows ALPC, likewise rated 7.8. It lets a low-privileged AppContainer escape its sandbox and reach SYSTEM. Notably, Microsoft had not patched ALPC since January 2023, when CVE-2023-21674 was addressed.

Both zero-days are local privilege escalations. Neither offers a way into a network on its own; they are the stage where an existing foothold, gained through phishing or a remote flaw, becomes full control and then persistence. That chain context is the right way to read them.

Roughly 20 wormable remote flaws

The same release contains about 20 vulnerabilities that ZDI assesses as wormable, meaning pre-authentication, zero-interaction remote code execution, and several carry CVSS 9.8. The list spans Windows DNS Server (CVE-2026-69730), Remote Desktop Services (CVE-2026-69525), Services for NFS ONCRPC XDR (CVE-2026-69595 and CVE-2026-78445), the Windows Shell (CVE-2026-69829), SSTP (CVE-2026-73009), RRAS (CVE-2026-69590), Netlogon (CVE-2026-72982), DHCP Server (CVE-2026-69845), the HTTP print provider (CVE-2026-69769) and Message Queuing (CVE-2026-69579).

One Exchange Server bug, CVE-2026-55007, stands out for its trigger: a malicious Visio attachment is processed by the server itself, and the recipient never needs to open it.

Deadlines and rollout order

CISA added both exploited zero-days to its Known Exploited Vulnerabilities catalog on 8 September 2026, with a 22 September 2026 remediation deadline for federal agencies. On Windows 11 24H2 and 25H2, the cumulative update arrives as KB5124008, build 26100.9445 or 26200.9445. Microsoft has also shortened its recommended installation window for critical quality updates to under three days, citing the speed at which attackers weaponise known gaps.

The dev.to write-up argues for ordering work by exposure rather than headline score: patch internet-reachable services first (DNS, RDP, RRAS, Netlogon, DHCP and Exchange), then domain controllers, then roll the cumulative update out broadly, and treat the escalation flaws as chain links where endpoint detection for unusual process elevation still matters.

Why it matters

CVE-2026-81963 is a case study in why CVSS scores understate risk in specific contexts. A 7.8 local privilege escalation in an ordinary component would rank behind the 9.8 remote bugs; one in the update stack, actively exploited and already in CISA's catalog, is different, because it undermines the assumption that a patched machine is a safe machine.

The release also illustrates a volume problem. Nearly a thousand fixes in one month is more than most teams can validate quickly, while Microsoft simultaneously pushes a sub-three-day window for critical updates. When capacity and urgency collide, exploitation status and exposure, not the severity number, are what should drive the queue.