Microsoft's September Patch Tuesday fixes 966 flaws including two exploited Windows zero-days

Microsoft's September 2026 Patch Tuesday batch fixes 966 vulnerabilities, and two of the patched flaws are Windows zero-days already being exploited in the wild, according to a BleepingComputer report. Both bugs are local privilege-escalation issues: they do not let a remote attacker break in on their own, but they let someone who already has a foothold on a machine jump from a low-privilege context to SYSTEM, the most powerful local account on Windows.

The two exploited flaws

The first, CVE-2026-81963, sits in the Windows Update Stack and stems from improper resolution of file links before file access. The second, CVE-2026-85880, is a heap buffer overflow in Windows Advanced Local Procedure Call (ALPC), the internal mechanism Windows components use to communicate between processes. Both carry a CVSS v3.1 base score of 7.8, and Microsoft flagged both as actively exploited when it shipped the fixes. They are also tracked through CISA's Known Exploited Vulnerabilities catalog, the standard reference for flaws observed in real attacks.

How exploitation works

Neither vulnerability is an entry point by itself. An attacker first needs to execute low-privilege code on the target system, which in practice usually means an earlier compromise through phishing, malware, or stolen credentials. The exact initial-access route used in the observed attacks has not been disclosed.

From that foothold, exploiting either flaw yields a SYSTEM token or equivalent elevated execution. Privilege escalation of this kind is a classic chaining component: initial access gives the attacker presence, and the escalation converts that presence into full control of the endpoint. With SYSTEM access, attackers can in principle disable security tooling, dump credentials, establish persistence through services or scheduled tasks, and move laterally using domain or cloud identities, although the specific follow-on activity in these incidents has not been made public.

What administrators should do

The primary action is straightforward: deploy the September 2026 Windows security updates and verify that systems have actually restarted and are running the updated build. Patching fleets that only download updates without completing installation leaves the exposure in place.

Beyond patching, defenders can reduce both the likelihood and the impact of this class of attack:

• Limit local footholds through application control, least-privilege account policies, and credential protection, since these flaws require pre-existing local code execution.
• Hunt on endpoints for suspicious elevation paths: a low-privilege process acquiring SYSTEM privileges, followed by new service or scheduled-task creation, is the signature pattern to look for.
• Review credential access and authentication activity on accounts tied to affected machines, both before and after patching, to determine whether escalation was leveraged further.
• Correlate outbound SMB, RDP, and similar connections with endpoint execution records when investigating possible lateral movement.

One useful forensic note from the analysis: an application crash on an endpoint demonstrates an exploitation attempt that failed, not a successful compromise. Confirmed exploitation requires evidence of a SYSTEM token or process actually being acquired.

Why it matters

Two factors make this month's release more urgent than the raw CVE count suggests. First, active exploitation means the attack playbook for these flaws is already in attackers' hands; every unpatched Windows system is a target for anyone who can pair the exploit with any initial-access technique. Second, the sheer volume of the batch — 966 fixes — creates practical pressure: the longer organizations stagger their rollout, the longer the two exploited zero-days remain open alongside everything else.

The bugs also illustrate why local privilege escalation should not be dismissed as a secondary concern. In real intrusions, elevation flaws are what turn a phished user account or a commodity malware infection into full endpoint control, credential theft, and a staging point for movement across the network. Microsoft's own guidance, as relayed by BleepingComputer, treats prompt deployment of the September updates as the priority control — and for environments that may already be compromised, patching is the starting point of the response, not the end of it.