Windows: CVE-2026-85880 and CVE-2026-81963 in CISA KEV — Escalation to SYSTEM

On September 8, 2026 — Patch Tuesday — CISA added two Windows vulnerabilities to its KEV catalog, the same day Microsoft published them. Both are local privilege escalations, and both lead to SYSTEM.

KEV added: 2026-09-08. CISA deadline: 2026-09-22.

NVD has published no CVSS score, vector or version list at the time of writing. I'm therefore relying solely on the CISA descriptions, and I won't invent build numbers: to identify the applicable fix you need Microsoft's monthly bulletin.

Why a Local Escalation Deserves Your Attention

This is the most common and most expensive triage reflex: seeing "local privilege escalation" and ranking the CVE below network-facing flaws. Two reasons not to.

A local escalation isn't the start of an attack, it's its second half. An attacker arrives via phishing, an attachment, a compromised web application — and ends up with standard user rights. At that point they can't disable antivirus, can't dump credentials from memory, can't install a persistent service, can't move laterally. All of that needs SYSTEM. Escalation is exactly what turns a compromised endpoint into a domain compromise.

Being in KEV means they're already in use. CISA doesn't add a CVE on a hypothesis. That both appear the same day they were published indicates exploitation was observed before a fix was available.

CVE-2026-85880 — heap overflow in ALPC

Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.

ALPC is Windows' internal inter-process communication mechanism. System components use it constantly to talk to one another, including across privilege boundaries — that's precisely its job.

That property makes it a long-standing target. An unprivileged process can legitimately open an ALPC channel to a service running as SYSTEM: that's normal operation. If handling a message on that channel contains a heap overflow, the attacker writes into a privileged process's memory using an authorised communication path.

ALPC has already produced several widely-exploited escalations. It's a dense, old surface, and hard to harden without breaking compatibility.

CVE-2026-81963 — link following in the Windows Update Stack

Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.

Link following (CWE-59) describes a family of flaws where a privileged component follows an attacker-controlled symbolic link or junction, and therefore writes somewhere it should never have reached.

The pattern is stable: an unprivileged user creates a link from a directory they can write to toward a protected target; a privileged service writes "into the temp directory"; the write lands on the target.

The Windows Update Stack is an ideal candidate: it runs as SYSTEM, it handles many temporary files, and it executes regularly without intervention. The attacker doesn't even need to trigger anything — they plant the link and wait for the next update cycle.

Notable irony: the component responsible for fixing vulnerabilities is here the escalation vector.

Versions and Fixes

Microsoft ships these fixes in the September 2026 cumulative updates. There's no independently applicable version number: the fix is that month's KB for your Windows branch.

Check installed updates:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

# Exact system build
[System.Environment]::OSVersion.Version
Get-ComputerInfo | Select-Object OsName, OsVersion, OsBuildNumber, WindowsVersion

Across a fleet:

# Machines with no update since a given date
Get-ADComputer -Filter * -Properties Name |
  ForEach-Object {
    $last = (Get-HotFix -ComputerName $_.Name -ErrorAction SilentlyContinue |
             Sort-Object InstalledOn -Descending | Select-Object -First 1).InstalledOn
    [PSCustomObject]@{ Machine = $_.Name; LastPatch = $last }
  } | Where-Object { $_.LastPatch -lt (Get-Date "2026-09-08") }

Detection

Privilege escalations leave few direct traces — detection targets what precedes and what follows them.

Anomalous child processes

The most usable signal:

# SYSTEM processes whose parent isn't an expected system process
Get-CimInstance Win32_Process |
  Select-Object ProcessId, Name, ParentProcessId, CommandLine |
  Where-Object { $_.Name -match "cmd|powershell|rundll32|regsvr32" }

A cmd.exe or powershell.exe running as SYSTEM whose parent is neither services.exe nor a legitimate service warrants immediate investigation.

Symbolic links and junctions

For CVE-2026-81963 specifically:

# Junctions in writable temporary directories
Get-ChildItem "$env:TEMP", "C:\Windows\Temp" -Force -ErrorAction SilentlyContinue |
  Where-Object { $_.LinkType -in @("SymbolicLink","Junction") } |
  Select-Object FullName, LinkType, Target

A link pointing from a temp directory to C:\Windows\System32 or any protected location is an unambiguous indicator.

Event logs

# Service creations — classic persistence after escalation
Get-WinEvent -FilterHashtable @{LogName='System'; ID=7045} -MaxEvents 50 |
  Select-Object TimeCreated, Message

# Scheduled tasks created
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TaskScheduler/Operational'; ID=106} -MaxEvents 50

LSASS access

An attacker who obtains SYSTEM will almost always go for credentials in memory. Sysmon event 10 (ProcessAccess) targeting lsass.exe from an unexpected process is one of the most reliable signals in the entire chain.

Mitigation

1. Deploy the September 2026 updates

The CISA deadline was September 22. Across a desktop fleet that means driving coverage as a metric, not simply triggering WSUS and assuming it worked.

2. Reduce what an escalation can reach

These two CVEs will be followed by others — local escalation is a permanent category. The measures that retain their value:

• LSA Protection (RunAsPPL) to complicate credential extraction from LSASS
• Credential Guard where the hardware allows
• No domain admin accounts used on desktop machines: that's what separates a compromised endpoint from a compromised domain
• LAPS, so the local administrator account isn't identical everywhere

3. Monitor rather than only patch

Local escalations will keep appearing. Detecting anomalous SYSTEM processes and LSASS access stays valid regardless of this month's CVE — it's an investment that doesn't expire.

Why Continuous Monitoring of Your Windows Estate Matters

Patch Tuesday publishes dozens of CVEs each month, only a handful of which are actually exploited. Telling them apart means cross-referencing Microsoft's bulletin with the KEV catalog and with your real inventory — manual work few organisations do every month, and which ends either in patching everything urgently or prioritising nothing at all.

With cveo.tech, inventory your Windows systems with their exact builds and get automatic alerts whenever a critical CVE — particularly a KEV-listed one — affects one of your versions. So Patch Tuesday becomes a short action list rather than a hundred-page bulletin.