Microsoft’s September Patch Tuesday closed an ALPC bug that lets code already running in a low-privilege AppContainer climb to SYSTEM. It is already in CISA’s KEV list. Bugs like this are how a browser exploit gets out of its sandbox.
This is not the Windows Update Stack zero-day fixed in the same release. It has its own CVE, fix and hunt.
CVE-2026-85880: a heap overflow in Windows ALPC
On September 8, 2026, Microsoft patched CVE-2026-85880, an Important elevation-of-privilege in Windows Advanced Local Procedure Call (ALPC). It’s a heap-based buffer overflow. Microsoft confirms exploitation in the wild.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
An attacker who can already run code in a low-privilege AppContainer can exploit ALPC locally, with no extra user click, to escape the sandbox and reach SYSTEM. ALPC sits under RPC, COM and core services on every supported Windows SKU. That is why ALPC privilege escalations so often complete browser or document sandbox exploits.
CISA listed it in KEV on 2026-09-08 with a federal due date of September 22, 2026 and forensic triage under BOD 26-04.
The second stage of a browser exploit chain
A sandboxed RCE still needs a reliable privilege escalation before the attacker owns the machine. This bug supplies it. Expect it to be paired with browser or document sandbox exploits from the same period.
Do not mix this up with CVE-2026-81963 (Windows Update Stack link-following EoP). That is a separate September zero-day. Close both tickets, and track each as its own patch and hunt.
Install September updates and check build numbers
- Deploy September 2026 cumulative updates on workstations and servers.
- Confirm build numbers, not just “updates installed.”
- Prioritize endpoints with heavy sandboxed workloads (browsers, Office Protected View, AppContainer LOB apps).
- Track CVE-2026-85880 and CVE-2026-81963 as separate items in patch dashboards.
- Where policy requires it, treat pre-patch exposure windows as BOD 26-04 forensic candidates.
Details
- CVE: CVE-2026-85880 (CVSS 7.8,
AV:L/AC:L/PR:L/UI:N) - Type: Heap-based buffer overflow (CWE-122); uninitialized-resource characteristics (CWE-908)
- Impact: AppContainer / low privilege → SYSTEM (local, no UI)
- KEV: Added 2026-09-08; due 2026-09-22; ransomware use: Unknown
- Related but distinct: CVE-2026-81963 (Update Stack EoP) — different zero-day
Example fixed builds (not a full list; verify your SKU on MSRC): Windows 10 22H2 19045.7725; Server 2016 14393.9512; Server 2019 17763.9245; Server 2022 20348.5622.
Hunt / verify
- Look for privilege transitions from AppContainer / low integrity processes to SYSTEM near ALPC activity.
- Confirm September cumulative build numbers on representative workstation and server images.
- Keep ALPC and Update Stack remediation tickets on separate compliance lines so one closed ticket doesn’t hide the other.
Sources
- MSRC: CVE-2026-85880 — Windows ALPC Elevation of Privilege
- CISA KEV catalog — CVE-2026-85880 (due 2026-09-22)
- SecurityWeek: September 2026 Patch Tuesday / exploited zero-days
- CrowdStrike: September 2026 Patch Tuesday Analysis
Related: see every Microsoft vulnerability CISA added to its exploited list in 2026, with the fix for each and links to our coverage.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
