CVE-2026-81963: Why a Windows Update Stack Flaw Matters More Than Its 7.8 Score

Microsoft's September 2026 Patch Tuesday addressed 974 CVEs, the largest monthly update ever released. Two of these vulnerabilities were already being exploited at the time of patch deployment. One, CVE-2026-81963, is a local privilege escalation flaw found within the Windows Update Stack - the component responsible for distributing patches.

This flaw, rated CVSS 7.8, combines two weaknesses: improper link resolution before file access (CWE-59) and improper access control. When exploited, it allows locally authenticated low-privileged attackers to gain SYSTEM-level privileges, bypassing the Windows Update Stack's validation process. The CVSS score of 7.8 reflects the risk rather than the severity of the flaw, as no user interaction is required and only local access is needed.

Notably, this is the first zero-day privilege escalation flaw in the Windows Update Stack to be both local and confirmed as exploited. Microsoft's patch tightens control, ensuring the update stack no longer follows malicious links, preventing attackers from overwriting system components. The second exploited zero-day in this release, CVE-2026-85880, is a heap buffer overflow in Windows ALPC (Application Layer Protocol Control), also rated CVSS 7.8.

This flaw enables a low-privileged AppContainer to escape the sandbox and reach SYSTEM. Microsoft had not patched ALPC since January 2023. Both flaws are local privilege escalations, but together they represent a critical step in the attack chain that typically involves phishing, remote exploitation, escalation, and persistence.

The release also contains around 20 vulnerabilities assessed as wormable, meaning they allow pre-authentication, zero-interaction remote code execution. Some of these vulnerabilities carry a CVSS of 9.8, including CVE-2026-69730 (Windows DNS Server) and CVE-2026-69525 (Windows Remote Desktop Services). Prioritizing the patching of internet-reachable services first, such as DNS, RDP, RRAS, Netlogon, DHCP, and Exchange, is advised due to their wide reach and vulnerability to pre-authentication RCE.