Severity Daily

IT and AI security incidents, checked against the primary source

Tag: CVE-2026-81963

  • Both Windows zero-days added to KEV today are rated Important at 7.8, and Microsoft’s own vector marks one exploit Unproven

    Both Windows zero-days added to KEV today are rated Important at 7.8, and Microsoft’s own vector marks one exploit Unproven

    Both Windows flaws CISA added to the Known Exploited Vulnerabilities catalog on September 8, 2026 are local privilege escalations rated Important at 7.8, and Microsoft’s own CVSS vector for one of them says the exploit code is unproven.

    What happened

    Microsoft released its September 2026 security updates on Tuesday, September 8, 2026. Two of the vulnerabilities in the release are flagged as exploited, and CISA added both to the Known Exploited Vulnerabilities catalog the same day.

    They are CVE-2026-81963, “Windows Update Stack Elevation of Privilege Vulnerability,” and CVE-2026-85880, “Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability.” Both titles are Microsoft’s own, taken from the Security Update Guide API.

    The NVD records for both carry CISA’s fields verbatim. cisaExploitAdd is 2026-09-08 for each. cisaActionDue is 2026-09-22 for each — in prose, federal civilian agencies have until September 22, 2026. CISA names the first “Microsoft Windows Link Following Vulnerability” and the second “Microsoft Windows Heap-Based Buffer Overflow Vulnerability.” NVD’s description of CVE-2026-81963 reads: “Improper link resolution before file access (‘link following’) in Windows Update Stack allows an authorized attacker to elevate privileges locally.” For CVE-2026-85880: “Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.”

    Both carry the same CVSS v3.1 base vector in NVD — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — for a base score of 7.8, High. Microsoft’s own severity label for both is “Important,” not Critical. Microsoft records both as not publicly disclosed before the update shipped.

    The Security Update Guide API returns a longer vector than NVD does, because Microsoft appends temporal metrics. This is where the two records stop matching:

    • CVE-2026-81963: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C — temporal score 7.2.
    • CVE-2026-85880: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C — temporal score 6.8.

    E:F is Exploit Code Maturity “Functional.” E:U is “Unproven.” Microsoft’s exploited field says “Yes” for both. So on the ALPC flaw, Microsoft is asserting active exploitation in one field and unproven exploit code in another, and the arithmetic that follows from the second one pushes the temporal score down to 6.8 — out of High and into Medium.

    Both API records were retrieved twice, with different URL forms, and returned identical vector strings and scores both times.

    The number nobody agrees on

    How large this release is depends on which outlet you read. SecurityWeek published “Microsoft Patches Record 974 Vulnerabilities” on September 8, 2026. BleepingComputer’s headline the same day says 966, and its body distinguishes 966 addressed on Patch Tuesday itself from 204 fixed earlier in September. CyberSecurityNews and NTCompatible both say 973. That is three different counts — 966, 973 and 974 — from four outlets, for one vendor release on one day.

    Severity Daily could not machine-count the release from this container. Microsoft’s Security Update Guide is a JavaScript application that returns nothing to a non-browser client, and the CVRF document for the month is too large to count reliably through a summarizing fetch. The counts above are therefore attributed to the outlets that published them, not verified. What is verified is the part that matters operationally: two CVEs, both exploited, both on the federal clock.

    Why it matters

    Start with the mismatch, because it is the kind of thing that quietly ruins a prioritization queue.

    Plenty of vulnerability management platforms consume CVSS temporal metrics when the vendor publishes them, on the reasonable theory that a vendor who tells you exploit code is unproven has told you something useful. For CVE-2026-85880 the vendor has told you two incompatible things in the same record. A tool that reads exploited: Yes puts the flaw at the top of the queue. A tool that reads the temporal vector scores it 6.8 and drops it below every 7.0 in the backlog. Both tools are reading Microsoft, and both are reading it correctly.

    The KEV listing is the tiebreaker, and it points the same way as the exploited field: CISA does not add anything to the catalog without evidence of exploitation. But KEV is a separate feed on a separate refresh cycle, and an organization whose triage runs on vendor CVSS alone will not see it. The practical instruction is narrow and worth stating plainly: on this pair, ignore the temporal score.

    The second thing worth sitting with is what the two exploited flaws actually are. In a release that the trade press is calling the largest Microsoft has ever shipped — and whose critical tier, per BleepingComputer’s breakdown, runs to 105 CVEs including 81 remote code executions — the only two flaws anyone has evidence of being used are local privilege escalations that Microsoft rates Important. Neither is remotely reachable. Both require the attacker to already be running code as some user on the box.

    That shape recurs, and it is worth naming: the flaw that gets exploited is frequently not the flaw that scores highest. Attackers who already have a foothold need to become SYSTEM, and a reliable local escalation is worth more to them than a critical RCE in a service they cannot reach. A patch program that sorts strictly by base score processes 105 criticals before it reaches either of these. A patch program that sorts by KEV listing reaches them first.

    The federal deadline is the third piece. September 22, 2026 is 14 days out, which under BOD 26-04 is one of the directive’s four remediation bands — three days, 14 days, 60 days, and a formal deferral tier. It is not the shortest. Which combination of the directive’s four binary variables — internet exposure, KEV listing, exploit automation, and total versus partial technical impact — produces a 14-day clock rather than a three-day one is something this publication will not assert, because CISA publishes that mapping as Table 1 in Appendix A as PNG images with no alt text, and the vendors who have transcribed it by eye disagree with each other about which combinations earn three days. The band is observable from cisaActionDue. The reasoning behind it is not machine-readable, by anyone, and that remains a problem with the directive rather than with the reader.

    Private-sector readers get no clock from CISA, only encouragement. Fourteen days is a reasonable one to borrow. Local privilege escalation is the second half of nearly every intrusion that starts with a phished credential or a compromised service account, and both of these have official fixes available today.

    What to do

    • Install the September 2026 Windows updates. Both CVEs are fixed in this month’s cumulative updates; Microsoft’s remediation level is RL:O, Official Fix, on both.
    • Sort by the KEV listing, not by the temporal score. If your scanner reports CVE-2026-85880 at 6.8, that number comes from Microsoft’s E:U metric and is contradicted by Microsoft’s own exploited flag and by CISA’s catalog. Treat it as exploited.
    • FCEB agencies: the due date is September 22, 2026, from cisaActionDue of 2026-09-22 on both records.
    • Prioritize hosts where an attacker plausibly already has user-level code execution — shared terminal servers, VDI pools, build agents, developer workstations. These are local escalations; that is where they pay off.
    • Do not treat “not publicly disclosed” as breathing room. Microsoft records both as not publicly disclosed and exploited anyway, which describes a targeted campaign rather than an absent one.

    Sourcing note

    Checked: NVD records for CVE-2026-81963 and CVE-2026-85880 at services.nvd.nist.gov, which carry CISA’s cisaExploitAdd, cisaActionDue, cisaVulnerabilityName and cisaRequiredAction fields verbatim — NIST republishing CISA. Microsoft’s Security Update Guide API at api.msrc.microsoft.com/sug/v2.0 for the titles, severity labels, temporal vectors, temporal scores, exploited and publiclyDisclosed fields; each of the two records was retrieved twice with different URL forms and returned identical values both times.

    Could not reach: cisa.gov returns 403 to automated fetching, so CISA’s own September 8, 2026 alert page was not read directly; the KEV dates and required-action text here come from NVD’s republication of those fields, which is the standing practice on this site. Microsoft’s Security Update Guide web page at msrc.microsoft.com/update-guide renders only under JavaScript and returned no content; the vendor data here comes from Microsoft’s own API instead, a second Microsoft host.

    Unresolved: the total CVE count for this release. Three figures are in circulation — 966, 973 and 974 — and they are reproduced above as attributed coverage, not as verified fact. CISA added four vulnerabilities to the catalog on September 8, 2026 according to the title of its own alert; the two Microsoft CVEs above are confirmed members of that batch, and the other two were not identified in time for this story. The contradiction between exploited: Yes and E:U on CVE-2026-85880 is reported as observed; Microsoft has not explained it, and no explanation was sought.