Microsoft released security updates addressing an unprecedented 974 vulnerabilities, headlined by two actively exploited zero-day privilege escalation flaws. Tracked as CVE-2026-85880 (CVSS 7.8), the first flaw is a heap buffer overflow in the Windows Advanced Local Procedure Call (ALPC) port architecture, allowing authenticated attackers to break out of low-integrity AppContainer sandboxes and achieve SYSTEM privileges. The second zero-day, CVE-2026-81963 (CVSS 7.8), resides in the Windows Update Stack, where improper link resolution allows local adversaries to manipulate NTFS junctions and redirect file writes to overwrite protected system binaries.

Telemetry from Volexity, Proofpoint, and Microsoft Threat Intelligence confirmed active in-the-wild exploitation of both flaws as secondary-stage elevation primitives chained with initial access vectors. In response, CISA added both vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog with a mandatory remediation deadline. Microsoft has issued cumulative security updates resolving the ALPC boundary errors and tightening symlink verification across all supported Windows client and server platforms.

Why it matters:

• Local sandbox escape and privilege escalation: ALPC heap corruption and update symlink manipulation allow threat actors with unprivileged footholds or sandboxed browser execution to gain unconstrained SYSTEM authority, neutralizing OS-level containment boundaries.
• Urgent patch deployment priority: Because these zero-days directly enable lateral movement and credential extraction, administrators must expedite cumulative September 2026 updates and prioritize endpoints running unsegmented or legacy Windows builds.