Microsoft Patches Two Exploited Windows Zero-Days

IPA warns two actively exploited Windows privilege escalation flaws (CVE-2026-81963, CVE-2026-85880) were fixed in Microsoft's September 2026 Patch Tuesday.

Japan's IPA (Information-technology Promotion Agency) issued its monthly advisory summarizing Microsoft's September 2026 security updates. Among the disclosed vulnerabilities, Microsoft has confirmed that two are being actively exploited in the wild: CVE-2026-81963, an elevation of privilege vulnerability in the Windows Update stack, and CVE-2026-85880, an elevation of privilege vulnerability in the Windows Advanced Local Procedure Call (ALPC) mechanism. Both flaws could allow an attacker to escalate privileges on a compromised Windows system, potentially leading to full control of the machine.

IPA urges organizations and individual users to apply the September 2026 security updates immediately via Windows Update or through managed patch deployment processes, given the confirmed in-the-wild exploitation and the risk of expanding attack activity. No further technical details, indicators of compromise, or attribution were provided in the advisory. As with all Patch Tuesday-cycle privilege escalation bugs, these are typically leveraged as a second stage following initial access to achieve local privilege escalation rather than as a standalone remote entry vector.

Source reporting: https://www.ipa.go.jp/security/security-alert/2026/0909-ms.html