Today, September 22, 2026, marks the hard deadline set by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) for federal civilian agencies to patch two actively exploited Windows privilege escalation vulnerabilities. The deadline applies under Binding Operational Directive 22-01 — but security experts are urging every organization, public and private, to treat today as a wake-up call.
The two vulnerabilities in question, CVE-2026-81963 and CVE-2026-85880, were first patched as part of Microsoft’s record-breaking September 2026 Patch Tuesday on September 8. They were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog the same day, triggering the standard two-week federal remediation window that expires right now.
What Are These Vulnerabilities?
Both flaws are Windows privilege escalation bugs carrying a CVSS base score of 7.8. While neither can be exploited remotely without existing access, that distinction matters less than it sounds — attackers who have already gained a foothold on a network will routinely use exactly these kinds of elevation-of-privilege vulnerabilities to move from a limited user account to full SYSTEM-level control.
CVE-2026-81963 is a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) mechanism — the internal inter-process communication system at the heart of Windows. An authenticated attacker with low privileges and no need for user interaction can trigger this overflow to execute code in the context of the SYSTEM account. It affects Windows 11 and Windows Server 2025. ALPC-based privilege escalation vulnerabilities have a storied history of being weaponized in ransomware delivery chains after initial access via phishing.
CVE-2026-85880 is a similar heap-based buffer overflow residing in the Windows Codecs Library and Windows Update Stack. Unlike its companion, this flaw is more broadly scoped — it extends to older Windows 10 and Windows Server branches still operating in extended security update (ESU) periods. According to the SOC Prime threat intelligence team, exploitation of CVE-2026-85880 was observed as early as late August, weeks before patches were available, making it a true zero-day at the time of the September 8 patch release.
CISA’s inclusion of both in the KEV catalog is significant: the agency only adds entries when it has confirmed, direct evidence of active exploitation in the wild — not merely theoretical risk. That stamp carries weight well beyond the federal government.
The September 2026 Patch Context
These two vulnerabilities did not arrive in isolation. Microsoft’s September 2026 Patch Tuesday was the largest single-month security update in the company’s history, addressing between 966 and 974 CVEs depending on which counting methodology is applied. That volume — nearly a thousand bugs in a single release — created an immediate prioritization challenge for security teams everywhere.
The sheer size of the patch load has itself become a risk factor. When teams face hundreds of updates to evaluate, triage, test, and deploy, critical fixes can slip. CISA’s KEV catalog exists precisely to cut through that noise: if a vulnerability is in the catalog, it is being exploited right now, and it requires immediate action regardless of whether internal patch management processes have completed their normal queue.
“The challenge with a record patch Tuesday is that the signal can get lost in the noise,” said one enterprise security architect quoted by SANS Internet Storm Center. “CISA’s two-week deadline is a forcing function. But that forcing function only works if you’re watching it.”
Why Private Sector Organizations Should Also Care
Binding Operational Directive 22-01 (BOD 22-01) formally applies only to Federal Civilian Executive Branch (FCEB) agencies. But the underlying logic — prioritize known-exploited vulnerabilities above everything else — is universally sound, and CISA has consistently encouraged private organizations to use the KEV catalog as a vulnerability prioritization tool.
Both CVE-2026-81963 and CVE-2026-85880 fit squarely into attacker playbooks that span every sector. Privilege escalation after initial access is a standard phase of nearly every modern ransomware attack, and heap-based overflow vulnerabilities in core OS components like ALPC have historically been prized by advanced persistent threat actors and criminal groups alike. The Lazarus Group, North Korea’s state-sponsored hacking team, was linked to ALPC exploitation campaigns as recently as August 2026.
Organizations that have not yet applied the September 8 Patch Tuesday updates are exposed. Given that both vulnerabilities require only low privileges and no user interaction after initial access, they represent near-zero-friction escalation paths for any attacker already inside a network.
What You Should Do Right Now
If your organization runs Windows 11, Windows 10, Windows Server 2025, or Windows Server 2019/2022, action is required:
Apply the September 2026 Patch Tuesday updates immediately. The cumulative updates KB5122880 (Windows 11 22H2/23H2) and KB5124008 (Windows 11 26H1) address CVE-2026-81963. Windows Server and Windows 10 users should apply the corresponding cumulative updates from the September 8 release cycle.
Verify patch deployment across your environment. In large organizations, patch management tooling doesn’t always reach every endpoint. Use Microsoft Intune, SCCM, or your preferred endpoint management platform to confirm the September updates are applied broadly, not just on managed devices.
Audit Windows ALPC exposure. CVE-2026-81963 targets an internal OS mechanism that can’t be disabled without breaking core functionality. The only mitigation is the patch. There is no workaround.
Check ESU coverage. CVE-2026-85880 affects older Windows 10 and Server branches. If your organization is running systems under extended security update agreements, verify that ESU licensing is active and updates are flowing. Windows 10’s final end-of-support deadline is October 2026, and systems that have not transitioned to ESU are now fully unpatched against this exploited flaw.
Enable CISA KEV monitoring. CISA’s Known Exploited Vulnerabilities catalog is publicly available at cisa.gov and updated continuously. Subscribing to updates — or integrating KEV data into your vulnerability management tooling — provides an automatic signal for which patches require emergency-tier treatment.
The Broader Trend: Exploitation Timelines Are Shrinking
Perhaps the most alarming aspect of CVE-2026-85880 is the pre-patch exploitation window. Attackers had weaponized this flaw before Microsoft even shipped a fix. That means organizations relying solely on “patch when the update drops” strategies are already behind when a zero-day is in play.
Security researchers have documented a consistent trend over the past two years: the time between vulnerability discovery and active exploitation continues to compress. What once took months now takes days or even hours for well-resourced threat actors. The Patch Tuesday model was designed for a slower threat landscape.
The practical implication is that vulnerability management programs must evolve. Compensating controls — network segmentation, endpoint detection and response (EDR) telemetry tuned to privilege escalation behaviors, and privileged access management (PAM) solutions that limit lateral movement — are no longer optional supplements. They are essential layers that buy time when patching cannot happen instantaneously.
Conclusion
Today’s CISA deadline is not just a federal bureaucratic milestone. It is a concrete reminder that two heap-based Windows vulnerabilities are being actively exploited against real organizations right now, and that the September 8 patch remains the only true fix for either of them.
If your organization’s Windows endpoints received the September 2026 cumulative updates, you can breathe easier. If not, the deadline has arrived — and the attackers already knew it before CISA did.
*Sources: CISA Known Exploited Vulnerabilities Catalog; Microsoft Security Update Guide (September 2026); SOC Prime CVE analysis; SANS ISC Diary; The Record / Recorded Future News; Tenable Patch Tuesday September 2026 coverage.*
