CVE-2026-85880: the ALPC sandbox escape explains why patch scores mislead

What was fixed, and when

Microsoft's September 2026 update fixed a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), tracked as CVE-2026-85880 and rated 7.8 under CVSS 3.1. The same month's release also fixed CVE-2026-81963 in the Windows Update stack, which is a link-following flaw in the same privilege boundary. Both were confirmed as exploited in the wild, and both needed a locally authenticated session to start from.
Tenable's coverage notes that this is the first ALPC fix since April 2023. That detail matters for planning: a component with few recent fixes is easy to under-rate in a vulnerability management pipeline, and an old but newly weaponised target behaves nothing like a freshly introduced one.

What the two flaws do to a host

ALPC is the kernel's local inter-process communication mechanism. Anything in a sandbox that can send a message can reach it, which is exactly what makes a buffer overflow there interesting: an attacker who can already run low-privilege code inside an AppContainer does not need a second remote exploit to escape confinement.
The Update stack flaw is a different shape. Windows Update reads and writes files while installing packages, and it did not validate a target path strictly enough. A local attacker who can place a symbolic link in advance can redirect that write onto a file they cannot normally reach.
Chained together, or used separately after a phishing or remote-access compromise, they carry a low-privilege foothold to SYSTEM. Neither is remotely triggerable on its own, which is the reason a 7.8 rating understates the operational value of the pair.

What to check on a host that may have been through this

Look for processes that left their sandbox container, and for parent-child relationships between a containerised process and anything running as SYSTEM. Check for symbolic links in the Windows Update working directories, and for newly created services, scheduled tasks or driver loads.
The broader September release is worth its own review pass: 20 fixes in that month's batch were rated wormable remote code execution, and the DNS Server flaw CVE-2026-69730 on a domain controller is a higher-consequence target than either zero-day even without an in-the-wild flag.

Where the limits are

An exploited-in-the-wild flag means someone used these flaws, not that every unpatched host is compromised. Attributing a damaged host to this identifier requires process, file and registry evidence. The severity rating is a scoring convention, and reading it as a schedule produces the wrong patch order.

References

1. Microsoft Security Response Center guidance for CVE-2026-85880
2. FreeBuf: Microsoft's largest Patch Tuesday covers 974 CVEs, two exploited zero-days and 20 wormable flaws
3. Analysis of the September 2026 Microsoft patch batch and the ALPC sandbox escape
4. InfoQ: Microsoft patches more than a thousand vulnerabilities in a single month