Microsoft Patches Two Exploited Windows Zero-Days
IPA warns two actively exploited Windows privilege escalation flaws (CVE-2026-81963, CVE-2026-85880) were fixed in Microsoft's September 2026 Patch Tuesday.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-81963 and CVE-2026-85880 as exploited in the wild.
Japan's IPA (Information-technology Promotion Agency) issued its monthly advisory summarizing Microsoft's September 2026 security updates. Among the disclosed vulnerabilities, Microsoft has confirmed that two are being actively exploited in the wild: CVE-2026-81963, an elevation of privilege vulnerability in the Windows Update stack, and CVE-2026-85880, an elevation of privilege vulnerability in the Windows Advanced Local Procedure Call (ALPC) mechanism. Both flaws could allow an attacker to escalate privileges on a compromised Windows system, potentially leading to full control of the machine.
IPA urges organizations and individual users to apply the September 2026 security updates immediately via Windows Update or through managed patch deployment processes, given the confirmed in-the-wild exploitation and the risk of expanding attack activity. No further technical details, indicators of compromise, or attribution were provided in the advisory. As with all Patch Tuesday-cycle privilege escalation bugs, these are typically leveraged as a second stage following initial access to achieve local privilege escalation rather than as a standalone remote entry vector.
Mentioned in this report
Source reporting: https://www.ipa.go.jp/security/security-alert/2026/0909-ms.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs