Microsoft patches 666 Windows flaws, two exploited

Microsoft's latest Windows update fixes 666 vulnerabilities, including 32 critical remote-code-execution bugs and two privilege-escalation flaws already under active exploitation.

NCSC-NL published a security advisory summarizing Microsoft's monthly Windows update, which addresses 666 vulnerabilities across numerous components. Of these, 32 are rated CVSS 9.0 or higher and allow unauthenticated remote code execution or security-bypass across components including NTFS, DNS, DHCP Server, RRAS, NFS ONCRPC, iSCSI, UxTheme Library, Imaging, XPS, Message Queuing, Netlogon, RPC Runtime, Hyper-V, Office Outlook, Remote Desktop Services, and others. The remaining 634 vulnerabilities range from medium to critical severity and cover a broad set of Windows subsystems.

Of particular concern to defenders are two privilege-escalation vulnerabilities that Microsoft has confirmed are being actively exploited in the wild: CVE-2026-81963 (Windows Update Stack, CVSS 7.8) and CVE-2026-85880 (Windows Advanced Local Procedure Call/ALPC, CVSS 7.8). Both require local, authenticated access and allow an attacker to elevate privileges to SYSTEM. No further details on exploitation techniques have been disclosed by Microsoft. Given the breadth of components affected — spanning core networking, filesystem, virtualization, and desktop services — and the presence of confirmed in-the-wild exploitation of privilege-escalation flaws, organizations should prioritize patch deployment, particularly to systems where local access by lower-privileged or already-compromised accounts is plausible.

Defenders should apply Microsoft's cumulative updates as soon as feasible, monitor for anomalous privilege escalation attempts on endpoints (especially involving Windows Update Stack or ALPC processes), and consult the MSRC portal for per-CVE guidance, affected product/version lists, and any available workarounds. Given the scale of this update (666 CVEs) and the confirmed active exploitation of two privilege-escalation bugs, this should be treated as a high-priority patch cycle rather than routine Patch Tuesday maintenance.

title: Suspicious Windows Update Stack Process Privilege Escalation
description: Detects suspicious privilege escalation activity via Windows Update Stack
  components. Monitors for child process creation from Windows Update-related services
  or unexpected token impersonation/elevation attempts. Targets CVE-2026-81963 and
  similar ALPC/privilege-escalation patterns where compromised low-privilege accounts
  abuse Windows Update mechanisms to gain SYSTEM.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_wus_parent:
    ParentImage|endswith:
    - \wuauserv.exe
    - \TiWorker.exe
    - \WaaSMedicSvc.exe
    CommandLine|contains:
    - CreateProcessAsUser
    - ImpersonateLoggedOnUser
    - AdjustTokenPrivileges
  selection_wus_child_suspicious:
    ParentImage|endswith:
    - \wuauserv.exe
    - \TiWorker.exe
    - \WaaSMedicSvc.exe
    Image|endswith:
    - \powershell.exe
    - \cmd.exe
    - \rundll32.exe
    - \regsvcs.exe
    - \cscript.exe
    - \wscript.exe
  filter_legitimate_windows_update:
    Image|endswith:
    - \setup.exe
    - \msiexec.exe
    - \rundll32.exe
    ParentCommandLine|contains: Windows Update
  condition: (selection_wus_parent or selection_wus_child_suspicious) and not filter_legitimate_windows_update
falsepositives:
- Legitimate Windows Update maintenance spawning msiexec for patch installation
- Windows Defender or third-party AV integrating with Windows Update stack
level: high
id: 93787d87-b1d5-58c4-9375-69a269bf4e2e
status: experimental
author: Vorant

title: ALPC-Based Privilege Escalation via Local Procedure Call
description: Detects suspicious Local Procedure Call (ALPC) activity indicative of
  privilege-escalation exploitation. Monitors for low-privileged processes (user context)
  attempting to call or open ALPC ports associated with high-privileged services.
  Targets CVE-2026-85880 and similar ALPC/token-elevation patterns.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_low_priv_process:
    User|contains:
    - DESKTOP
    - LAPTOP
    CommandLine|contains:
    - \Device\MailslotManager\
    - \Device\LPC
    - AlpcSendWaitReceivePort
  selection_alpc_exploit_indicators:
    CommandLine|contains:
    - NtAlpcSendWaitReceivePort
    - RpcServerListen
    - OpenAlpcPort
    Image|endswith:
    - \svchost.exe
    - \services.exe
    ParentUser|contains:
    - DESKTOP
    - LAPTOP
  condition: selection_low_priv_process or selection_alpc_exploit_indicators
falsepositives:
- RPC-based applications in user context communicating with system services (rare)
- Custom enterprise applications using ALPC for inter-process communication
level: medium
id: f70275ea-a67d-5fe8-ab0f-2effe6c0fbd0
status: experimental
author: Vorant

title: Exploitation Attempt via Remote Code Execution Vector
description: Detects network-based exploitation attempts targeting high-CVSS remote
  code execution vulnerabilities in Windows components (NTFS, DNS, DHCP, RRAS, RPC
  Runtime, Remote Desktop Services). Monitors for unexpected remote connections followed
  by abnormal child process spawning from vulnerable system services.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_vulnerable_service_child:
    ParentImage|endswith:
    - \dnsserver.exe
    - \dhcpsrv.exe
    - \rasmans.exe
    - \svchost.exe
    - \lsass.exe
    - \rpcss.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    - \rundll32.exe
    - \regsvcs.exe
    - \certutil.exe
  filter_legitimate_svchost:
    CommandLine|contains:
    - Windows Update
    - maintenance
    - scheduled
  filter_legitimate_rpc:
    Image|endswith: \svchost.exe
    CommandLine|contains: RpcEptMapper
  condition: selection_vulnerable_service_child and not (filter_legitimate_svchost
    or filter_legitimate_rpc)
falsepositives:
- Scheduled maintenance scripts spawning cmd/powershell from system services
- RPC-based administrative tools or backup agents
level: high
id: e70a1dcf-e9d2-598f-97fe-b4a6dbc5b008
status: experimental
author: Vorant

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0353.html