Microsoft’s October Patch Tuesday lands tomorrow. Before it does, it is worth spending twenty minutes on the last one, because September’s release carried two actively exploited zero-days that both end in SYSTEM — and “patched in September” is a claim you should verify, not assume.
The two bugs
Both are local elevation-of-privilege flaws rated CVSS 7.8. Neither provides remote access on its own, which is the reason they tend to get deprioritised. That is the wrong instinct, and we will get to why.
CVE-2026-81963: Windows Update stack, link following
This is an improper link resolution issue: the update stack can be tricked into opening or modifying the wrong file by following a shortcut-style pointer. A local attacker uses that to gain SYSTEM. Credit goes to an outside researcher and Microsoft’s own threat intelligence team, and no exploitation details were published. That last point matters — you cannot write a detection for a technique nobody has described, so patching is your only real control.
CVE-2026-85880: ALPC heap buffer overflow
ALPC is the internal inter-process messaging system Windows components use to talk to each other. A heap-based overflow there lets an attacker with code execution inside a low-privilege AppContainer break out of the sandbox and elevate, with no user interaction needed. It was reported by Volexity and by researchers at Proofpoint, two firms that spend their days looking at real intrusions. That is a decent hint about where it was being used.
Both are covered in BleepingComputer’s September Patch Tuesday write-up and Malwarebytes’ summary.
Why “local only” is not comfort
A local privilege escalation is the second step in an intrusion, not the first. The first step is a phishing payload, a compromised VPN account, a malicious browser extension or a vulnerable app. Once that foothold exists, the attacker’s next question is simply “how do I get SYSTEM?” Each exploited LPE answers it.
The ALPC bug is especially relevant to sandboxed code. AppContainer is designed to limit the damage from a compromised app. A sandbox escape converts “they got into the browser’s renderer” into “they own the machine.”
And if your users are still local admins, the question never needs answering at all. Standing admin rights make every bug like these irrelevant to the attacker, because they already have what the exploit would give them. Removing local admin does not make you immune to SYSTEM-level LPEs, but it removes the cheaper path and forces the attacker to spend an exploit.
What good looks like for verification
Your patch dashboard says “installed” for September. Treat that as a starting point. Specifically:
- Check build numbers, not deployment status. Query the OS build and UBR across the fleet and compare against the September cumulative update for each Windows version you run. Deployment rings that report “succeeded” while devices sit pending reboot are common.
- Find the pending reboots. An update that is staged but not applied does not protect you. Count devices with a pending restart older than seven days.
- Look at the tail. Laptops that rarely connect, VDI images that were not rebuilt, and servers excluded from automatic maintenance windows are the machines an attacker lands on and exploits.
- Don’t forget Windows 10 ESU. If you still run Windows 10 under Extended Security Updates, confirm those devices are enrolled and received the update; unenrolled devices will not.
Compensating controls while you chase stragglers
- Enforce application control (WDAC or App Control for Business, or AppLocker at minimum) so an unknown binary dropped by an attacker cannot run in the first place.
- Make sure EDR is in blocking mode and tamper protection is on. Earlier this year, exploit tooling that disabled or starved Defender updates was seen in real intrusions.
- Alert on new services, scheduled tasks and unexpected SYSTEM child processes, particularly spawned from user-writable paths.
- Restrict who can log on interactively to servers. An LPE on a jump host is worth far more than one on a kiosk.
What to do now
- Run a build-level compliance report against the September cumulative update today, per Windows version.
- List devices with pending reboots or no check-in in 14 days, and assign owners.
- Force restarts on the stragglers during tonight’s maintenance window rather than waiting for users.
- Confirm application control and EDR tamper protection are enforced, not just configured.
- Review how many users still hold standing local admin — that number is your exposure multiplier for the next LPE.
- Tomorrow, read October’s list for anything marked exploited, and decide your emergency-ring timing before the release, not after.
Exploited zero-days are the one category where “wait for the normal ring” is rarely the right answer. Make sure the previous month’s are truly closed before the next batch arrives.
