Posted on

Microsoft Windows September Zero-Days – CVE-2026-85880 and CVE-2026-81963

Threat Overview

Microsoft’s September 8, 2026 security release addressed two Windows elevation-of-privilege vulnerabilities that Microsoft reports are being exploited in the wild. CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC). Microsoft states that an attacker who already has code execution in a low-privilege AppContainer can exploit the flaw locally to escape the sandbox and elevate to SYSTEM without additional user interaction. CVE-2026-81963 is an improper link-resolution-before-file-access vulnerability in the Windows Update Stack that allows an authorized local attacker to elevate privileges.

Both vulnerabilities are post-compromise privilege-escalation issues rather than initial-access vulnerabilities. Their importance to MSSP customers is the ability to turn low-privilege execution into full SYSTEM control. Public reporting confirms active exploitation but does not disclose the malware families, exploit chain, file names, command lines, or other exploitation-specific telemetry. Hunting must therefore focus on vulnerable asset identification and high-signal privilege-escalation outcomes without pretending there is a CVE-specific behavioral signature.

References

Impacted Systems

Vendor/product: Microsoft Windows. Components: Windows Advanced Local Procedure Call (ALPC) and Windows Update Stack. CVE-2026-85880: local, low-privilege attack; an attacker with code execution in a low-privilege AppContainer can escape the sandbox and elevate to SYSTEM; no additional user interaction is required. CVE-2026-81963: local, low-privilege link-following flaw in Windows Update Stack; successful exploitation elevates privileges. Microsoft released fixes on September 8, 2026. Exact affected builds vary by supported Windows release and should be validated against the corresponding Microsoft Security Response Center advisory. Older or end-of-support Windows versions may require Extended Security Updates or migration depending on product lifecycle.

Why this matters

These vulnerabilities are confirmed exploited zero-days in broadly deployed Windows components. They are valuable to attackers after initial access because SYSTEM-level execution enables credential theft, defense evasion, persistence, lateral movement, and deployment of additional tooling.

Criticality: High – Immediate patching and targeted hunt priority because exploitation is confirmed.

Exploitation Status

Confirmed active exploitation. Microsoft reported exploitation for both CVE-2026-85880 and CVE-2026-81963 as part of the September 8, 2026 security release. Public sources reviewed do not identify the threat actor, malware, initial-access vector, exploit file name, or a CVE-specific process pattern.

What this hunt looks for

Available Microsoft Sentinel telemetry can be reviewed for devices still exposed to the two CVEs, suspicious integrity-level transitions, unusual child processes from sandbox-associated processes, anomalous execution from Windows Update components, new services, and privileged local-account or group changes where Defender XDR or Windows Security Events are ingested.

Required logs

  • Microsoft Defender Vulnerability Management: DeviceTvmSoftwareVulnerabilities
  • Microsoft Defender XDR / Defender for Endpoint: DeviceProcessEvents
  • Windows Security Events in SecurityEvent, including 4688, 4720, 4732, and 7045 where enabled

First Pass – Devices Exposed to Either Exploited CVE

DeviceTvmSoftwareVulnerabilities
| where CveId in~ ("CVE-2026-85880","CVE-2026-81963")
| project DeviceName, DeviceId, OSPlatform, OSVersion, OSArchitecture, CveId, VulnerabilitySeverityLevel, SoftwareVendor, SoftwareName, SoftwareVersion, RecommendedSecurityUpdate
| order by DeviceName asc

Low or Medium Integrity Process Spawning High or System Integrity Child

DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessIntegrityLevel in~ ("Low","Medium")
| where ProcessIntegrityLevel in~ ("High","System")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessIntegrityLevel, FileName, ProcessCommandLine, ProcessIntegrityLevel, SHA256
| order by TimeGenerated desc

Sandbox-Associated Process Spawning Administrative or LOLBin Child

DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("RuntimeBroker.exe","ApplicationFrameHost.exe","msedge.exe","chrome.exe","firefox.exe")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","regsvr32.exe","mshta.exe","wscript.exe","cscript.exe","schtasks.exe","sc.exe","net.exe","net1.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessIntegrityLevel, FileName, ProcessCommandLine, ProcessIntegrityLevel
| order by TimeGenerated desc

Suspicious Children of Windows Update Components

DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("TiWorker.exe","TrustedInstaller.exe","UsoClient.exe","MoUsoCoreWorker.exe")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","regsvr32.exe","mshta.exe","wscript.exe","cscript.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessIntegrityLevel, SHA256
| order by TimeGenerated desc

New Windows Services Following Possible Privilege Escalation

SecurityEvent
| where TimeGenerated > ago(14d)
| where EventID == 7045
| project TimeGenerated, Computer, SubjectUserName, ServiceName, ServiceFileName, ServiceType, ServiceStartType
| order by TimeGenerated desc

New Local Users and Local Administrators Group Changes

SecurityEvent
| where TimeGenerated > ago(14d)
| where EventID in (4720,4732)
| project TimeGenerated, Computer, EventID, SubjectAccount, SubjectUserName, TargetAccount, TargetUserName, MemberName
| order by TimeGenerated desc

Windows Process-Creation Fallback for Privileged Shells

SecurityEvent
| where TimeGenerated > ago(14d)
| where EventID == 4688
| where NewProcessName has_any (@"\cmd.exe",@"\powershell.exe",@"\pwsh.exe",@"\rundll32.exe",@"\regsvr32.exe",@"\mshta.exe")
| where ParentProcessName has_any (@"\RuntimeBroker.exe",@"\ApplicationFrameHost.exe",@"\TiWorker.exe",@"\TrustedInstaller.exe",@"\UsoClient.exe",@"\MoUsoCoreWorker.exe")
| project TimeGenerated, Computer, SubjectUserName, ParentProcessName, NewProcessName, CommandLine
| order by TimeGenerated desc

Detection Notes

The asset-exposure query is the most reliable first pass when Microsoft Defender Vulnerability Management data is available. The behavioral queries are intentionally post-exploitation focused because Microsoft has not publicly disclosed CVE-specific exploit artifacts. A low-to-high integrity transition is not proof of exploitation and must be correlated with parent process, user context, file reputation, and surrounding activity. The Windows Update component query is a suspicious-outcome pivot, not a claim that either exploit necessarily spawns those processes. SecurityEvent 4688 requires process-creation auditing and command-line capture to be useful. Without Defender XDR or detailed Windows process telemetry, exploitation may only become visible through downstream persistence or account changes.