Threat Intel Windows CISA KEV

Two Windows SYSTEM zero-days landed on one September Patch Tuesday

Sep 9, 2026·9 min read·Chris Boker, Founder, CVEasy AI
Two parallel privilege escalation tracks converging on a single SYSTEM tile: the upper track shows a Windows Update Stack pipeline whose middle step is redirected by a gold dashed symlink arc to an off-lane rust target file; the lower track shows a fixed-size mint ALPC buffer of eight cells with a mint arrow overshooting the last cell into an adjacent gold kernel metadata block whose function pointer slot lights up rust; both tracks funnel right into a large green SYSTEM shield stamped with a small gold KEV clock.

Two of the four CVEs CISA added to its Known Exploited Vulnerabilities catalog on September 8, 2026 do not touch a perimeter, do not need a login prompt, and are not what most triage queues open on Wednesday morning. Both are local, both land at CVSS 7.8, and Microsoft says both were exploited in the wild before the fix shipped. CVE-2026-81963 is in the Windows Update Stack; CVE-2026-85880 is in Windows Advanced Local Procedure Call. Each hands SYSTEM to whoever already has code on the box, and a CVSS 7.8 sort buries them under every internet-facing 9 and 10 in your queue. CISA disagreed with that ordering the day the patches shipped.

Two local wins that ship you SYSTEM

CVE-2026-81963 is a link-following flaw (CWE-59) in the Windows Update Stack, credited to Romain Deperne of Airbus Helicopters and the Microsoft Threat Intelligence Centre. It is the first Update Stack elevation-of-privilege zero-day reported as exploited in the wild since 2022, when Microsoft patched seven such bugs in a single year. A service running as SYSTEM opens a file at a path a lower-privileged user can influence, follows a redirect the user planted, and performs its trusted operation against a target the user was never supposed to touch. Help Net Security and CSO Online converge on the same primitive.

CVE-2026-85880 is a heap-based buffer overflow (CWE-122) in the Windows Advanced Local Procedure Call subsystem. Microsoft's advisory lists Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2012 R2, 2016, 2019, and 2022 as affected, and calls out an AppContainer sandbox escape path. CIRCL's Vulnerability-Lookup entry mirrors the same CWE and CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) vector.

How the Update Stack loses to a symlink race

Windows Update runs as SYSTEM because it needs to write into paths a normal user cannot. If any step of that workflow resolves a file path through a link a lower-privileged user planted, the SYSTEM process performs its trusted operation against a file the attacker chose. A standard user cannot create NTFS symbolic links in system directories, but a standard user can create object-manager symlinks under \RPC CONTROL\ and chain them with an NTFS junction from a directory the user does own, producing a pseudo-symlink that reaches almost any target on disk. When the SYSTEM service traverses one of those junctions and performs its next action against the redirect target, you get arbitrary file write as SYSTEM. This is the same surface ZDI walked through in 2024 and the same class that has produced Update Stack LPEs in every prior year the primitive appeared. Microsoft has not named the specific component that mishandled the resolve, and no public PoC has landed.

How ALPC overwrites a kernel buffer from an AppContainer

ALPC is the connection-oriented, message-passing IPC that lives inside the Windows kernel, and it is what Chromium sandboxes, Office child processes, and most modern Windows services use to talk to their brokers. A client opens a handle to a named port and exchanges messages that carry immediate data inline or a pointer to a larger data view the kernel maps on receipt. The overflow here is a mismatch between the length field the caller sends and the buffer the kernel actually allocated before the copy runs.

What that mismatch buys an attacker with code inside an AppContainer, a browser renderer, or a Chromium extension host is a controlled write into the kernel heap chunk adjacent to the undersized buffer. On the pool the ALPC path uses, neighboring chunks contain the structures every kernel LPE researcher has been targeting for a decade: object headers, pointer fields, and function references the kernel dereferences on the next unrelated operation. A sprayed pool with the right adjacent object plus a controlled overflow of a known length converts to a function-pointer overwrite and arbitrary code execution at kernel privilege. From an AppContainer, that is exactly the sandbox escape Microsoft calls out. The subsystem stays a favorite target (see depthfirst on smashing the heap over IPC); the September 2026 variant was already in the wild when the patch shipped.

Why base score is the wrong sort for a KEV LPE

A queue ranked by base score puts these behind every 8-and-above finding; a queue ranked by AV:N puts them behind every internet-facing finding. Neither matches how LPEs are used. Local privilege escalation is what a foothold turns into a domain compromise, and every phishing landing that dropped a stealer, every remote-support installer a helpdesk employee ran, and every Chromium sandbox a drive-by hit yesterday is now sitting on a laptop with two brand-new SYSTEM primitives Microsoft says are already active. The AppContainer path on the ALPC bug means the attacker does not even need to break out of a browser first. CISA put both CVEs on KEV the day the patches landed; treat that clock as yours too.

The 7.8 tell. Two Windows LPE zero-days, both at CVSS 7.8, both on CISA KEV the same day the patch shipped. A base-score sort buries them below every 9-and-above finding. A KEV filter puts them at the top of your list, which is where CISA thinks they belong.

The TRIS layer walk for these two CVEs

TRIS is the Threat and Risk Intelligence Scoring engine inside CVEasy AI. It reads CVSS as one input, and blends it with layers that answer who is running this and how exposed that instance is. Three layers move the number on today's pair.

Exploitation status. KEV listed the day of the fix, and Microsoft's advisory reports exploitation detected. That lands at the top of the exploitation column, not near it. TRIS keeps a proven PoC and confirmed in-the-wild abuse as separate signals on purpose.

Blast radius on your fleet. The Update Stack ships on every supported Windows client and server, and ALPC lives in the same kernel every AppContainer talks to. TRIS reads the affected-version list against your inventory, weights unpatched hosts by count and role, and lifts the score for fleets whose patch window runs longer than a week.

Reachability of the primitive. A local EoP means nothing on a bastion no one has code on. It means everything on a call-center laptop that just clicked a link, a developer workstation running an unsigned installer, or a Citrix session host that hands remote users a Windows shell. TRIS reads the population of foothold-realistic hosts and scores the EoP against the class of intrusion your telemetry is already seeing.

The upshot: the same CVE-2026-81963 hits top-band ACT on a fleet with foothold pressure and thin EDR coverage, and lands lower on a hardened image no user directly touches. That is why a base-score-first queue mis-ranks a KEV LPE Microsoft has already seen exploited.

What to patch, hunt, and rotate this week

Patch. The September 2026 cumulative updates fix both CVEs. Deploy across your Windows fleet with your usual staged rollout, but front-load hosts most likely to carry a foothold: internet-facing terminal servers, contractor laptops, VDI images that get user-initiated installs, and anything whose EDR flagged an unusual process in the last thirty days. Treat the FCEB KEV deadline as a ceiling, not a target.

Interim mitigation. Microsoft has not published a workaround for either CVE. Restricting object-manager symlink creation and watching junction creation in user-writable profile directories reduces the Update Stack surface without closing it. The ALPC bug has no clean pre-patch mitigation, because ALPC is used by too much of the operating system to disable. The patch is the mitigation.

Hunt. For the Update Stack primitive, look in your EDR for junction or reparse-point creation from non-admin user contexts targeting paths under C:\ProgramData\, C:\Windows\SoftwareDistribution\, and C:\Windows\Temp\, followed by SYSTEM-context file writes to the same paths in a short window. For the ALPC path, watch for atypical child processes of Chromium renderers or Office brokers that end up as SYSTEM without a documented reason.

Rotate. Any host that had a foothold in the last thirty days could have had SYSTEM. Rotate LAPS local admin passwords, invalidate cached domain credentials and Kerberos tickets, and refresh any keys or tokens reachable to a SYSTEM process. The primitive does not leave a clean audit trail.

Rotate on suspicion, not on confirmation. Both primitives were exploited in the wild before the September patch shipped, and neither leaves an obvious log. Rotate LAPS local admin passwords, cached domain credentials, and any host-reachable tokens on suspect endpoints without waiting for confirmed second-stage activity.

How CVEasy AI surfaces this

CVEasy AI is the number one local-first CTEM platform. It ingests CISA KEV, MSRC advisories, and researcher write-ups as they publish, matches every new CVE against the Windows build inventory you already scanned, and hands TRIS a picture that includes exploitation status, your patch-window realities, and your EDR coverage. For today's pair, that means the two zero-days show up at the top of your triage queue with a shortlist of the hosts that matter, a remediation plan naming the KB, and a hunt query for each primitive. All of it runs on your hardware. None of your inventory leaves the box.

Sources: CyberInsider on the September 2026 Patch Tuesday, CVE Security entry for CVE-2026-85880, CIRCL Vulnerability-Lookup, Help Net Security, CSO Online, Security Affairs on the KEV addition, depthfirst research on ALPC heap smashing, ZDI on Windows privilege-escalation techniques