CVE-2026-85880 and CVE-2026-81963: Microsoft Patches Two Actively Exploited Windows Zero-Days

**Microsoft September 2026 Patch Tuesday:** Two actively exploited Windows local privilege escalation flaws—CVE-2026-85880 (heap overflow in ALPC affecting Windows 10/Server generations) and CVE-2026-81963 (improper link resolution in the Windows Update Stack affecting Windows 11/Server 2025)—both rated CVSS 7.8 and patched on September 8, 2026; CISA added them to its KEV catalog with a September 22 remediation deadline, and defenders are advised to prioritize patching, verify build levels, and hunt for behavioral indicators of sandbox escape and SYSTEM-level activity.