Sandbox escape is the other half of a browser exploit kit. Microsoft’s September Patch Tuesday closed an ALPC bug that lets code already running in a low-privilege AppContainer climb to SYSTEM — and it’s already in CISA’s KEV list.
One important bookkeeping note up front: this is not the Windows Update Stack zero-day from the same release. Different CVE, different fix, different hunt.
What happened
On September 8, 2026, Microsoft patched CVE-2026-85880, an Important elevation-of-privilege in Windows Advanced Local Procedure Call (ALPC). It’s a heap-based buffer overflow. Microsoft confirms exploitation in the wild.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
An attacker who can already run code in a low-privilege AppContainer can exploit ALPC locally — no extra user click — to escape the sandbox and reach SYSTEM. ALPC sits under RPC, COM, and core services on every supported Windows SKU, which is why ALPC LPEs so often finish browser or document sandbox RCEs.
CISA listed it in KEV on 2026-09-08 with a federal due date of September 22, 2026 and forensic triage under BOD 26-04.
Why it matters
A sandbox RCE without a reliable LPE is half a kit. ALPC to SYSTEM is the other half. Pair this with any browser or document sandbox exploit in the same window.
Do not mix this up with CVE-2026-81963 (Windows Update Stack link-following EoP). That is a separate September zero-day. Close both tickets — but treat them as separate patch and hunt stories.
What to do first
- Deploy September 2026 cumulative updates on workstations and servers.
- Confirm build numbers, not just “updates installed.”
- Prioritize endpoints with heavy sandboxed workloads (browsers, Office Protected View, AppContainer LOB apps).
- Track CVE-2026-85880 and CVE-2026-81963 as separate items in patch dashboards.
- Where policy requires it, treat pre-patch exposure windows as BOD 26-04 forensic candidates.
Details
- CVE: CVE-2026-85880 (CVSS 7.8,
AV:L/AC:L/PR:L/UI:N) - Type: Heap-based buffer overflow (CWE-122); uninitialized-resource characteristics (CWE-908)
- Impact: AppContainer / low privilege → SYSTEM (local, no UI)
- KEV: Added 2026-09-08; due 2026-09-22; ransomware use: Unknown
- Related but distinct: CVE-2026-81963 (Update Stack EoP) — different zero-day
Example fixed builds (non-exhaustive — verify your SKU on MSRC): Windows 10 22H2 19045.7725; Server 2016 14393.9512; Server 2019 17763.9245; Server 2022 20348.5622.
Hunt / verify
- Look for privilege transitions from AppContainer / low integrity processes to SYSTEM near ALPC activity.
- Confirm September cumulative build numbers on representative workstation and server images.
- Keep ALPC and Update Stack remediation tickets on separate compliance lines so one closed ticket doesn’t hide the other.
Sources
- MSRC: CVE-2026-85880 — Windows ALPC Elevation of Privilege
- CISA KEV catalog — CVE-2026-85880 (due 2026-09-22)
- SecurityWeek: September 2026 Patch Tuesday / exploited zero-days
- CrowdStrike: September 2026 Patch Tuesday Analysis
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
