Two Windows EoP zero-days landed in CISA KEV on Patch Tuesday. The 974-CVE count is not the story.

Microsoft confirmed exploitation of CVE-2026-81963 in the Update Stack and CVE-2026-85880 in ALPC. CISA listed both on 8 September. Patch those first; the haystack is a separate problem.

RWP Ventures · 2026-09-09 · event 2026-09-08 · 11 min read · priority 8.6

The record count is a capacity problem for patch programs. It is not the intelligence problem. The two KEV entries are local privilege-escalation primitives on the Windows fleet — the step that turns a phished user or a sandbox foothold into SYSTEM. They are not remote worms. They do not need to be. Ransomware and post-compromise kits have used this class of bug for years.

CISA’s same-day KEV drop also listed [CVE-2026-75650 (Adobe Commerce / StyleSmuggler)](/posts/2026-09-08-adobe-stylesmuggler-hotfix-cve-2026-75650/) and CVE-2026-86218 (N-able N-central). Those two are internet-facing, pre-auth, and carry BOD 26-04 forensic-triage flags. The Windows pair does not. Sequence accordingly: Magento and on-prem N-central if you run them, then every Windows build that still lacks the September cumulatives, then the rest of this release by reachability — DNS, Netlogon, Exchange, SharePoint — not by CVE count.

What happened

Microsoft published the September Security Updates on 8 September 2026. The MSRC release note counts 974 Microsoft CVEs across Windows (723), Office (111) plus Office 2016 (111), SQL (62), Developer Tools (22), SharePoint (16), Azure (12), Skype for Business (10), Exchange (9), and Other (9). Independent counters differ by a few dozen depending on whether they include early-month cloud CVEs, Chromium/Edge, and republished third-party IDs. Use MSRC’s 974 for Microsoft-owned product CVEs; treat 966–999 as the same event counted differently.

The two exploited bugs:

CVE-2026-81963 — Windows Update Stack. CWE-59 (link following) and CWE-284. An authorized local attacker elevates to SYSTEM. Credited to Romain Deperne and Microsoft Threat Intelligence Centre (MSTIC). Microsoft’s temporal metrics include Exploit Code Maturity: Functional. Help Net Security, citing Tenable, reports this is the first exploited zero-day among seven Update Stack privilege-escalation bugs since 2022, and that it hits Windows 11 trains and Windows Server 2025. Automox’s Serena DiPenti’s point, quoted by Recorded Future, is the operational one: an attacker who owns the update stack owns the mechanism you would use to evict them.

CVE-2026-85880 — Windows ALPC. Heap-based buffer overflow. An authorized local attacker elevates to SYSTEM. Microsoft’s FAQ is explicit: an attacker who can execute code in a low-privilege AppContainer can exploit this locally to escape the sandbox; no additional user interaction is required. Credited to Volexity and to Mark Kelly, David Galazin, and Jeremy Hedges at Proofpoint. Help Net Security reports the patch set covers Windows 10 and older Server trains (2012, 2016, 2019, 2022). Rapid7 separately noted that neither Windows 11 nor Server 2025 received an ALPC patch in this release, which Rapid7 assesses as a possible effect of kernel-component rewrites — ASSESSED, not a Microsoft statement that those SKUs are immune.

CISA’s 8 September alert added four KEV entries:

Ransomware-use flag on all four: Unknown.

Hours after the release, a researcher using the Nightmare Eclipse / MSNightmare persona published a proof-of-concept named ShieldCrash, claiming Microsoft’s August fix for Defender ShieldBreak (CVE-2026-69414) left an arbitrary file-read-as-SYSTEM path. Microsoft had not confirmed a new CVE as of this writing. Treat ShieldCrash as REPORTED researcher disclosure, not as a third exploited Patch Tuesday zero-day.

Why it matters

Two facts sit on top of each other and should not be collapsed.

First: these are local bugs. They do not, on the evidence Microsoft and CISA published, give an unauthenticated internet attacker a shell. An operator who sequences “974 Criticals” ahead of “two Important KEVs” because CVSS looks larger will leave the post-compromise ladder on every workstation.

Second: the rest of the release is not noise. Trend Micro’s Zero Day Initiative counts on the order of 20 unauthenticated, no-user-interaction remote-code-execution patches that it classifies as potentially wormable — DNS (including CVE-2026-69730, which ZDI calls a spiritual successor to SigRed), DHCP, MSMQ, NFS ONCRPC, RRAS, SSTP, Netlogon, Failover Cluster, RMCAST, IP Helper, ICS. CrowdStrike independently flags unauthenticated network RCE across DNS, DHCP, MSMQ, NFS, and SSTP, plus Netlogon CVE-2026-72982 (CVSS 9.8) and Kerberos CVE-2026-69676 (Exploitation More Likely per ZDI). None of those 20 are in KEV today. None are confirmed exploited. They are the next queue after the two that are.

Exchange is a separate track. ZDI highlights CVE-2026-55007: a remote, unauthenticated attacker sends a malicious Visio attachment; Exchange processes it; no Preview Pane required. Microsoft calls the exploit unreliable. Unreliable unauthenticated mail-processing RCE on Exchange is still a scheduled-downtime item. CVE-2026-69380 (missing authorization, mailbox impersonation by a low-privilege mailbox holder) is the post-phish expander: one compromised account, every mailbox. Microsoft’s exploitability assessment on 69380 is Exploitation Less Likely / not exploited.

Office adds a Preview Pane / Reading Pane cluster. CrowdStrike counts 12 Critical Office/graphics bugs triggerable by previewing a crafted file. That is phishing-shaped initial access, not a KEV, and it ships in the same cumulatives as the two exploited EoPs for Windows — but Office and Exchange have their own servicing.

For industrial operators: there is no confirmed OT/process impact from either zero-day. Windows Update Stack and ALPC run on engineering workstations, jump hosts, historians, and HMI PCs. A SYSTEM EoP on those assets is an IT compromise adjacent to OT. Do not write it up as a PLC event.

Who / what is affected

Do not use the 974 figure as an inventory. Map product families you actually run, then patch in the order above.

Technical context

Microsoft’s own language is enough for defense. CVE-2026-81963 is improper link resolution before file access in the component that installs Windows updates. CVE-2026-85880 is a heap overflow in ALPC, the local RPC/COM transport, with an explicit AppContainer-escape FAQ. RWP is not reproducing gadget maps, symlink layouts, or ALPC message shapes.

ATT&CK mapping for the confirmed pair, not the hypothetical wormables:

• Privilege escalation: exploitation for privilege escalation (T1068)
• Defense evasion / sandbox escape: escape to host (T1611) for the AppContainer path on CVE-2026-85880
• Persistence adjacent: once SYSTEM, typical follow-on is service or scheduled-task persistence (T1543 / T1053) — ASSESSED pattern, not observed in Microsoft’s write-up
• The Update Stack location matters for recovery: if the installer is the primitive, “we pushed the patch” is not by itself evidence the host was clean when the stack last ran

ZDI’s wormable list and CrowdStrike’s DNS/Netlogon/SSTP notes are reachability priorities, not confirmed campaigns. SigRed (CVE-2020-1350) was a wormable Windows DNS RCE. Calling CVE-2026-69730 its successor is ZDI’s assessment of class and impact, not a statement that a worm exists.

Threat / exploitation status

High confidence on existence, vendor confirmation of exploitation, KEV listing, and CVSS/CWE for the two Windows bugs. Moderate confidence on the Windows 11 vs Windows 10 version split (secondary reporting, MSRC product tables did not render cleanly in the sources used here — verify against the Security Update Guide per SKU). Low confidence on how widely either EoP is being used, and on ShieldCrash until Microsoft or a second independent lab reproduces it.

What defenders should do

1. Inventory the two internet-facing KEVs first if you have them. Magento/Adobe Commerce: VULN-39341 plus Adobe’s encryption-key and credential rotation, and BOD 26-04 forensic triage before you call it closed — see [yesterday’s assessment](/posts/2026-09-08-adobe-stylesmuggler-hotfix-cve-2026-75650/). On-prem N-central: 2026.3 Hotfix 4 (build 2026.3.1.14). Hosted N-central was patched server-side. Federal due date for both is 11 September.
2. Push the September Windows cumulatives for CVE-2026-81963 and CVE-2026-85880. Confirm the KBs that actually apply to each build in the Security Update Guide; do not assume one article covers every SKU. Install the latest servicing stack update first (ADV990001). For Windows 10, this is an ESU problem as much as a security problem.
3. Do not treat “Exploitation Detected” local EoPs as “hunt every host before patching.” CISA did not set a BOD 26-04 forensic-triage flag on either Windows KEV. Patch, then hunt endpoints that already had a low-privilege foothold: unexpected SYSTEM child processes from user-writable paths, AppContainer breakouts, and Update Stack activity that does not match your patch ring.
4. Second wave, by exposure, not by CVSS: internet-facing SSTP/RRAS and Exchange; then domain controllers (DNS, Netlogon, Kerberos); then DHCP, MSMQ (TCP 1801), NFS (2049) where those roles exist; then SharePoint; then Office Preview Pane. Disable MSMQ and NFS where they are leftover roles. ZDI’s Exchange guidance is still right: schedule the downtime.
5. SAP OVERPASS (CVE-2026-44756, Note 3747649) is a kernel patch, not a Windows problem. If you run S/4HANA, ECC, NetWeaver, or Web Dispatcher 9.16, it is in the same 24-hour window and is unauthenticated. It is not KEV. It is still a HotNews note with no single network control that Onapsis considers sufficient.
6. Do not run untrusted ShieldCrash PoCs on production. There is no Microsoft advisory and no CVE for the claimed bypass. Wait for MSRC or a second lab.

This is not an exploitation guide. Use MSRC, CISA KEV, and your patch catalog.

RWP assessment

Score 8.6. Two vendor-confirmed exploited Windows bugs, same-day CISA KEV, and a release large enough that teams will mis-sequence it. It outranks Magento’s new KEV listing because that listing is a material follow-up to two successive Daily Tops, not a new technical finding, and because the Windows fleet is the common denominator for nearly every reader. It outranks SAP OVERPASS because OVERPASS is not exploited. It outranks MikroTik MikroTrick (CERT Polska: unauthenticated SSH takeover via CVE-2026-67276 + CVE-2026-86060, exploited since at least 2 September, patches in 7.24.2 / 7.23.4 / 6.49.21) because that campaign is four days old with a vendor fix already in the field — still patch-now for anyone with internet-exposed RouterOS SSH, not today’s primary.

The 974 number will dominate headlines. The decision is: KEV local EoPs on Windows today; internet-facing Magento and N-central yesterday and still open; wormable-class DNS/Netlogon/SSTP and Exchange this week; SAP kernel on a parallel track if you have it.

What we are watching

• Whether Microsoft or a vendor names a campaign or implant using CVE-2026-81963 or CVE-2026-85880.
• Whether any of ZDI’s 20 wormable-class RCEs, especially DNS CVE-2026-69730 and Netlogon CVE-2026-72982, move to “Exploitation More Likely” in practice or into KEV.
• Microsoft’s response to ShieldCrash, and whether Malware Protection Engine servicing closes it without a new CVE.
• N-central and Magento KEV due dates (11 September) and whether BOD 26-04 triage actually happens outside FCEB.
• SAP OVERPASS: first public exploit or KEV nomination.
• MikroTik: whether “ops” account creation and the Flagged mechanism show up outside the two IPs CERT Polska already published (82.192.72.4, 103.102.31.18).

Sources

• Microsoft September 2026 Security Updates
• Microsoft CVE-2026-81963
• Microsoft CVE-2026-85880
• CISA — four KEV additions, 8 September 2026
• CISA Known Exploited Vulnerabilities Catalog
• Zero Day Initiative — September 2026 Security Update Review
• CrowdStrike — September 2026 Patch Tuesday analysis
• BleepingComputer — September 2026 Patch Tuesday
• Help Net Security — record patch count, two zero-days, SigRed successor
• Rapid7 (via Cyber Daily) — September Patch Tuesday count and ALPC SKU note
• [RWP Daily Top, 8 September 2026 — Adobe StyleSmuggler hotfix](/posts/2026-09-08-adobe-stylesmuggler-hotfix-cve-2026-75650/)