Small Town Sysadmin
Free CJIS checklist

Active Directory

Security alert

Two Windows flaws from September Patch Tuesday are being exploited

Microsoft confirmed attacks using two Windows privilege-escalation flaws fixed on September 8. If your September updates aren't installed yet, install them now.

Microsoft’s September 8, 2026 security updates fixed two Windows vulnerabilities that were already being exploited, and CISA added both to its Known Exploited Vulnerabilities catalog the same day. If any of your Windows PCs or servers haven’t installed September’s updates, install them now.

What they are

Both are elevation of privilege flaws. An attacker who already has a foothold on a computer (a phishing email, a malicious download, a compromised user account) can use either one to gain full SYSTEM control of that machine. That’s how attackers go from “one user clicked something” to “they own the whole computer,” and often the network after that.

CVE Component Microsoft’s assessment
CVE-2026-81963 Windows Update Stack Exploited: Yes. Gains SYSTEM privileges. CVSS 7.8
CVE-2026-85880 Windows Advanced Local Procedure Call (ALPC) Exploited: Yes. Gains SYSTEM privileges

Microsoft’s listing for these updates includes versions all the way back to Windows Server 2012 and 2012 R2, which receive them only through Microsoft’s paid Extended Security Updates program. Check the Microsoft pages below for your exact version and its update number.

What to do

  1. Install the September 2026 cumulative updates on every Windows PC and server, then reboot.
  2. Check for stragglers. Laptops that were off, servers with postponed reboots, and machines whose updates keep failing are the usual gaps. Most management tools can report which devices are missing a given month’s update.
  3. Older servers: if you still run Windows Server 2012 or 2012 R2 without Extended Security Updates, these fixes aren’t available to you. Plan to replace them. See retiring old domain controllers for how to approach that safely.

For office managers

Make sure every computer in the office has installed its latest Windows updates and been restarted. If an IT company manages your PCs, ask them to confirm September’s updates are installed everywhere.

Sources

All articles