Published Wednesday, September 09, 2026 at 05:32 PM PT

<strong>CRITICAL: Microsoft Patches Two Actively Exploited Windows Privilege Escalation Zero-Days</strong>

BLUF: Microsoft’s September 2026 Patch Tuesday includes fixes for CVE-2026-85880 and CVE-2026-81963, two Windows privilege escalation vulnerabilities already exploited in active attacks. Both allow local attackers to escalate to SYSTEM access. Patch immediately on all Windows systems; exploitation requires local access but no user interaction.

DETAILS

  • Both CVE-2026-85880 and CVE-2026-81963 are Windows privilege escalation flaws carrying CVSS 7.8 severity
  • Vulnerabilities are actively exploited in the wild — in-the-wild exploitation is confirmed, not theoretical
  • Attack chain: attacker with initial local access (compromised account, physical access, or lateral movement from network compromise) can escalate privileges to SYSTEM without additional user action
  • Microsoft addressed both in September 2026 Patch Tuesday cycle
  • Both are zero-days — previously unknown and unpatched before this cycle

IMPACT

Affected systems: All Windows systems running unpatched versions; specific version matrix not yet itemized from available reporting.

Exposure: High for systems where attackers have already gained a foothold (malware infection, compromised credentials, or insider threat). Escalation-to-SYSTEM enables full system compromise, lateral movement into domain infrastructure, and persistence mechanisms.

Scope: Windows estate-wide; no macOS or Linux exposure from these specific CVEs.

RECOMMENDED ACTIONS

  1. Immediate: Apply Microsoft September 2026 Patch Tuesday updates to all Windows systems, prioritizing servers and critical infrastructure within the next 48 hours. Patch deployment should not wait for stability testing given active exploitation.

  2. Detection: Monitor for attempted exploitation via Windows privilege escalation indicators (unusual token creation, SeDebug privilege grants, SYSTEM process spawning from user contexts). Correlate with suspicious local process activity post-intrusion discovery.

  3. Inventory: Confirm Windows version coverage in your environment and validate patching completion via telemetry/MDM reports before de-prioritizing.

  4. Assume breach: If you operate in high-threat sectors or have recent incident indicators, assume exploitation may have already occurred and conduct forensic review of SYSTEM-level process spawning in the 30 days prior to patch deployment.

SOURCES

  • SOC Prime: CVE-2026-85880 and CVE-2026-81963 Microsoft advisory
  • Microsoft September 2026 Patch Tuesday release notes

Recent high-severity events at publish time:

Recent high-severity events