Microsoft's Record 973-CVE Patch Tuesday: Two SYSTEM-Level Zero-Days Under Attack
September 2026 is Microsoft's largest Patch Tuesday on record, and two of the fixes — both elevation-of-privilege bugs — are already being exploited to seize SYSTEM control on Windows machines.
Key Takeaways
- Microsoft's September 2026 Patch Tuesday fixes 973 CVEs — its largest single release to date.
- Two elevation-of-privilege flaws, CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), are confirmed under active exploitation and grant SYSTEM access, not remote code execution.
- Both bugs need an attacker to already have a foothold on the box — they're second-stage tools, which is why they matter more to defenders than their CVSS 7.8 scores suggest.
- At this scale, CVSS-only prioritization breaks down; exploitation status and exposure should drive patch order, not severity labels alone.
Microsoft's September 2026 Patch Tuesday addresses 973 CVEs, the largest single monthly update the company has shipped. Buried in that volume are two elevation-of-privilege (EoP) bugs Microsoft confirms are being actively exploited: CVE-2026-85880 in the Windows Advanced Local Procedure Call (ALPC) component, and CVE-2026-81963 in the Windows Update Stack. Both carry a CVSS base score of 7.8 and let an attacker who already has local code execution escalate straight to SYSTEM.
Why two 7.8s matter more than the headline count
On a scorecard, 7.8 looks modest next to the Critical-rated remote-code-execution bugs that also shipped this month. But CVSS measures technical severity, not operational risk. These two flaws are not initial-access vectors — they're the second stage. An attacker who has landed on a machine via phishing, a web app compromise, or a stolen credential uses exactly this class of bug to go from a low-privileged foothold to full SYSTEM control, at which point EDR tampering, credential dumping, and lateral movement all become far easier.
That's precisely why both are already in the wild: EoP-to-SYSTEM primitives are reusable, reliable, and valuable to almost any intrusion, from ransomware crews to targeted operators. Microsoft has not disclosed who is exploiting them or against whom, which is normal for actively-exploited advisories but means defenders should assume opportunistic, not narrowly targeted, use.
The scale problem is now the story
A 973-CVE month is itself a signal worth sitting with. Patch Tuesday has grown steadily heavier over the past several cycles, and a release this size stresses the part of vulnerability management that tooling doesn't fix: triage capacity. Security teams that patch in Microsoft's severity order, or on a fixed monthly cadence, will likely address these two EoP bugs well after attackers have already weaponized them — because neither is flagged Critical and neither is an RCE.
What should actually drive patch order this month
- Exploitation status first. Both actively-exploited CVEs should be patched ahead of higher-CVSS bugs that have no known exploitation — that's the entire point of Microsoft's 'Exploitation Detected' flag.
- Don't treat EoP as low priority by default. In any environment where initial access is plausible (i.e., all of them), an EoP-to-SYSTEM bug closes off a cheap, reliable escalation path for whatever gets in first.
- Expect this volume to recur. Build a triage process — exploited status, internet exposure, asset criticality — that scales to 900+ CVE months, rather than one tuned for the 100-150 CVE releases of a few years ago.
None of this changes the mechanics of patch management — test, stage, deploy, verify — but it does change what 'urgent' should mean this cycle. The two flaws worth losing sleep over aren't the ones with the biggest CVSS numbers; they're the ones Microsoft has confirmed someone is already using.
Frequently Asked Questions
What are the two actively exploited zero-days in Microsoft's September 2026 Patch Tuesday?
CVE-2026-85880, an elevation-of-privilege flaw in Windows ALPC, and CVE-2026-81963, an elevation-of-privilege flaw in the Windows Update Stack. Both are rated CVSS 7.8 and let an attacker with existing local access escalate to SYSTEM.
Are the two exploited CVEs remote code execution bugs?
No. Both are local elevation-of-privilege vulnerabilities, meaning an attacker needs an existing foothold on the machine before they can use them — they escalate privileges rather than granting initial access.
Why does a 973-CVE Patch Tuesday matter beyond the raw number?
The volume strains triage capacity: teams that patch strictly by CVSS severity or wait for a monthly cycle risk leaving actively-exploited, lower-scored bugs like these two unpatched longer than the flashier Critical-rated RCEs.