Microsoft’s September 2026 Patch Tuesday update is out, and it closes two Windows security holes that attackers were already using before a fix existed. The update lands as KB5124008 for Windows 11 24H2 and 25H2 (builds 26100.9445 and 26200.9445), with a matching KB5122880 for Windows 11 22H2/23H2, both released on September 8.
SecurityWeek reports Microsoft fixed 974 vulnerabilities across Windows, Office, SQL Server, Exchange, SharePoint, Azure and developer tools this month, calling it a record for the company. Cyber Security News, which tallied Microsoft’s own release notes independently, put the breakdown at 438 elevation-of-privilege bugs and 258 allowing remote code execution. Other trackers report slightly different totals, but every count lands close to a thousand.
Two zero-days already under attack
The number that matters most to a Windows user is two, the flaws Microsoft confirms were exploited in the wild before today’s fix shipped.
The first, CVE-2026-85880, is a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) component. A local attacker who can already run code in a low-privilege sandboxed app could use it to break out and gain full System access. “An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system. No additional user interaction is required,” Microsoft says in its advisory, as reported by SecurityWeek. Tenable senior staff research engineer Satnam Narang notes it is the second zero-day in the ALPC component in nearly four years, after CVE-2023-21674 in January 2023.
The second, CVE-2026-81963, sits in the Windows Update Stack itself, the mechanism that installs updates. It is an improper link-resolution flaw. An attacker with a foothold on a machine can trick the update process into acting on files it shouldn’t. That lets them climb to elevated privileges too.
Neither vulnerability lets an outsider break in from the internet on its own. Both require an attacker to already have some code execution or access on the machine. From there, the flaw lets them climb from a limited foothold to full control. That is exactly the kind of second-stage bug that turns a minor infection, a malicious browser extension, or a compromised low-privilege app into a complete system takeover.
What else is in this update
KB5124008 also carries the taskbar repositioning, Start menu resizing and Search privacy controls this site covered as they rolled out through August’s preview builds, now folded into the stable cumulative update. It fixes the Teams and Outlook crash on Arm64 PCs, a cursor personalization bug, and Remote Desktop audio redirection issues, and it removes the legacy WMIC command-line tool from Windows entirely.
What to do
Go to Settings > Windows Update and select Check for updates to install KB5124008 (or KB5122880 on 22H2/23H2) if it hasn’t installed automatically. Both zero-days are already being used against real systems, so this is not an update worth deferring, especially on shared or work PCs where a single compromised app is enough to trigger the escalation path both bugs open.
Sources: SecurityWeek, Cyber Security News
