CVE-2026-81963: Windows Update Stack Bug Exploited as Zero-Day

Microsoft's September 2026 Patch Tuesday fixed two Windows vulnerabilities that attackers were exploiting before patches were available. One of them, CVE-2026-81963, is a first for its component. It is the first Windows Update Stack flaw known to have been exploited in the wild. It arrived in the largest monthly patch release Microsoft has shipped so far, which makes it a useful test of how defenders should prioritize when the number of fixes keeps rising.

What happened

The two zero-days are CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in the Windows Advanced Local Procedure Call (ALPC) component. Both let an attacker escalate privileges to SYSTEM. 14 Each has a CVSS score of 7.8 and is rated Important, not Critical. 23

CVE-2026-81963 is an improper link resolution bug, also called a link-following flaw. An authorized local attacker can abuse symbolic-link handling to gain SYSTEM privileges. 23 Adam Barnett of Rapid7 said the fix ships for every supported Windows version. In his view, it likely tightens controls so the Update Stack cannot be tricked into following a malicious link and overwriting a system component with an attacker-controlled copy. 3 Microsoft's Threat Intelligence Center (MSTIC) is credited with the discovery. 2

CVE-2026-85880 is a heap-based buffer overflow in ALPC. 23 It allows a local attacker to break out of a low-privilege AppContainer sandbox and reach SYSTEM without any user interaction. Volexity and Proofpoint share the credit. 2

Why the Update Stack bug stands out

Tenable counts seven privilege escalation flaws in the Windows Update Stack since 2022. CVE-2026-81963 is the first of them to be a zero-day and the first to be exploited in the wild. 3 Zero Hunt makes the same point. 2

The history explains why this matters. The servicing stack runs with high privileges and writes to protected parts of the operating system, because that is its job. A flaw that lets an attacker redirect those writes turns a trusted maintenance process into a privilege escalation tool. Earlier bugs in this component were apparently fixed before anyone weaponized them. This one was not, which suggests attackers now consider the update machinery worth the effort.

Who discovered the bugs may also say something about who was using them. Zero Hunt notes that names like Volexity and MSTIC usually appear on bugs found during incident response or threat-actor tracking. 2 That points toward targeted operations rather than opportunistic crime, although none of the coverage names a specific actor or campaign. That remains an inference, not a confirmed attribution.

A record month, counted two ways

Outlets disagree on the total. BleepingComputer, as cited by WindowsForum, and Zero Hunt put the count at 966 flaws, including 105 Critical and 81 remote code execution bugs. 12 SecurityWeek, The Hacker News, and CyberScoop report 974. 134 Differences like this usually come from whether third-party, Chromium-based, or previously released CVEs are counted. Either way, all sources agree it is Microsoft's biggest release ever. 34

CyberScoop links the growing volume to Microsoft's use of AI to find vulnerabilities faster. 4 WindowsForum describes Microsoft warning admins that AI will keep inflating Patch Tuesday and calling for faster, risk-based patching. 1 Dustin Childs of Trend Micro's Zero Day Initiative said AI-assisted discovery "shows no signs of slowing down." He added that there has been no matching spike in active exploitation, "yet." 4

The scoring problem

Zero Hunt highlights a gap between severity labels and real-world risk. Of the hundreds of flaws fixed, the only two under active attack are not Critical and are not remote code execution bugs. 2 A team that patches strictly by CVSS score or Critical label would put both behind dozens of theoretical RCEs.

Local privilege escalation bugs can look minor on paper. In practice, they are the second stage of most intrusions. A phishing payload or sandboxed browser exploit gets the attacker in, and something like CVE-2026-85880 or CVE-2026-81963 gives them full control. The ALPC flaw's sandbox-escape ability and the Update Stack flaw's coverage of every supported Windows version make both strong candidates for exploit chains.

The takeaway

Record patch counts tend to draw the headlines. The more important signal this month is exploitation of a component that had never been hit before. CyberScoop's sources recommend that customers focus on their own exposure rather than raw volume. 4 That advice works only if confirmed in-the-wild exploitation outranks base scores. For Windows admins, that means deploying the fixes for CVE-2026-81963 and CVE-2026-85880 first, ahead of most of the Critical-rated items in the rest of the release.