Windows Zero-Day CVE-2026-85880: What to Do Now

Microsoft patched a Windows zero-day on September 8, 2026 that lets an attacker already running code in a sandboxed app or browser tab break out and take full SYSTEM control of the machine, and it is confirmed under active exploitation on unpatched Windows 10 and older Windows Server versions. That is CVE-2026-85880, a flaw in a Windows component called ALPC. If you run Windows 10 or Windows Server 2012 through 2022, today’s job is to install the September 2026 cumulative update, reboot, and take a hard look at any machine that is too old to get the fix at all. This note is the plain-English version, written for the person who just saw the advisory.

The source is Microsoft’s own MSRC advisory, which lists exploitation as detected. It shipped in the September 2026 Patch Tuesday alongside a second actively exploited privilege-escalation bug, CVE-2026-81963, which hits the newer Windows versions this one does not. The trade press has not posted its roundups yet as of this writing, so the facts below come straight from Microsoft. Actively exploited bugs like this also tend to appear in CISA’s Known Exploited Vulnerabilities catalog shortly after.

What’s actually broken

CVE-2026-85880 is a memory-corruption flaw in Windows ALPC, scored 7.8. ALPC, short for Advanced Local Procedure Call, is the internal messaging system Windows processes use to talk to each other on the same machine. The bug is a combination of a heap buffer overflow and use of an uninitialized resource, CWE-122 and CWE-908 if you track those. In plain terms, code sends carefully malformed messages through that channel to corrupt memory and take over a more privileged process.

What makes this one worth attention is where it starts and where it ends. It starts inside a sandbox, an AppContainer, which is the locked-down box Windows runs risky code in. A modern browser tab runs in one of these. The whole point of the sandbox is that if the code in it is malicious, the damage stays contained. This flaw lets that code escape the sandbox and climb all the way to SYSTEM, the highest level of access on the machine. Once code is already running in the sandbox, no click or extra step is needed.

That is the difference between this and an ordinary local privilege-escalation bug. A normal one assumes an attacker already has a real foothold. This one turns a contained, low-trust process, the kind you were relying on the sandbox to keep harmless, into full control. The safety net you were counting on is the thing that gets removed.

The part that will bite people is the end-of-life list. Windows Server 2012 and Windows 10 only get this fix through paid Extended Security Updates. If you are not enrolled, there is no patch coming, and no amount of clicking check for updates will produce one. For those machines the honest answer is migrate or isolate, not patch.

Kip LeGate, Chief Security Officer, azpentest

Who this affects

Windows 10 versions 1607, 1809, 21H2, and 22H2, and Windows Server 2012, 2012 R2, 2016, 2019, and 2022, including Server Core installations. This is an older-machine problem. If your desktops are on Windows 11 and your servers are on 2025, you are looking at the companion CVE instead. If you still run Windows 10 anywhere, or a Windows Server from 2019 or earlier, you are squarely in scope.

Running these versions is common and not shameful. Plenty of businesses have a Windows 10 machine driving a piece of equipment, or a Server 2016 box that has done its one job for years. The finding is not that they exist. It is whether they have this month’s update, whether they rebooted, and, for the oldest of them, whether they can even receive the fix. That last point is the part most coverage will skip, so it gets its own section below.

What to do today

The update is the fix. The work is confirming it reached every machine and that each one restarted. Whoever manages your endpoints can run these. We are an independent second opinion, not a replacement for them.

1. Confirm the September 2026 cumulative update installed. On a sample machine, open Settings, then Update and Security, then Windows Update, then View update history, and look for a cumulative update dated September 8, 2026 or later marked Installed. At the command line, Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 lists recent updates with dates.

2. Verify the build revision, not just the date. Run winver and read the build number. The digits after the dot climb with every cumulative update. Compare that against the post-update build Microsoft lists for your exact Windows or Windows Server version in the September 2026 release notes. If yours is lower, the update is not actually applied.

3. Confirm the reboot happened, after the update. The fix goes live only after a restart, and an installed-but-not-restarted machine is still exploitable. Check with Get-CimInstance Win32_OperatingSystem | Select-Object LastBootUpTime; if the last boot predates the install, it has not restarted since patching. A pending reboot also leaves a marker at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired. Servers are the usual offenders here, because nobody wants to reboot them during the day.

4. Verify the fleet, do not trust the rollout. In Intune, WSUS, or your RMM tool, pull the real installation-status and reboot-pending report rather than assuming the policy worked. On older servers especially, updates stall silently. The common failure is a report that reads “installed, pending reboot” while someone treats it as finished.

The end-of-life problem hiding in the affected list

Some of the affected versions are already past Microsoft’s support, and for those the September patch does not arrive automatically. Windows Server 2012 and 2012 R2 reached end of extended support in October 2023. Windows 10 reached end of support in October 2025. Machines on those versions receive a fix like this one only if they are enrolled in Microsoft’s paid Extended Security Updates program. If they are not enrolled, there is no cumulative update coming, and no amount of clicking check for updates will produce one.

That changes the answer for those machines. The fix is not “patch and reboot,” it is “migrate off it, or isolate it hard.” If a business-critical box has to stay on an end-of-life version for a while, the honest interim step is to reduce what it can reach and what can reach it: keep it off the internet, tighten which accounts and machines can talk to it, and treat it as untrusted. That is a stopgap, not a fix. A machine that cannot receive security updates is a standing exposure, and this CVE is a concrete example of the cost. If you are not sure which of your machines are past support, that inventory is worth building today.

The other zero-day from the same day

CVE-2026-85880 shipped next to CVE-2026-81963, a separate actively exploited privilege-escalation bug in the Windows Update Stack that affects the newer Windows 11 and Server 2025 machines this one does not. Between the two, one September release carries two live exploitation paths across old and new Windows alike. That is the case for installing the whole cumulative update and rebooting everything, rather than sorting machines by which bug they happen to have.

How you’d know if you were exposed

The real question is not this one CVE. It is whether you know which machines you run, whether they get patched and rebooted on a schedule, and whether any of them are quietly past end of life. An internal penetration test is the independent version of that check. From a foothold inside the network, a tester looks for the machines running behind, the privilege-escalation and sandbox-escape paths from a low-trust process to SYSTEM, and the end-of-life boxes that can no longer be fixed and are holding the door open.

Those forgotten older machines are a common finding, precisely because they are easy to lose track of and hard to retire. A test surfaces them before an attacker does, and it does it without alarm: you get a plain, prioritized list of what to patch, what to isolate, and what to finally replace. It is also how you show an insurer or a board that your patch process and your inventory both actually work. Internal testing at azpentest starts at $6,500, retest included; the published tiers are on pricing.

Frequently asked questions

Is CVE-2026-85880 being actively exploited right now?

Yes. Microsoft’s advisory lists exploitation as detected as of the September 8, 2026 release. Attackers are using it to break out of a low-privilege sandbox, like the one a browser tab runs in, and take full SYSTEM control of the machine. It was not publicly known before the patch shipped, but that no longer helps you once the fix and the attacks are both public.

What Windows and Windows Server versions does CVE-2026-85880 affect?

Windows 10 versions 1607, 1809, 21H2, and 22H2, and Windows Server 2012, 2012 R2, 2016, 2019, and 2022, including Server Core. Several of these are end of life, so the fix reaches them only if you are enrolled in Microsoft’s Extended Security Updates program. If you are not, the real fix is migrating off them.

What is an AppContainer sandbox escape, in plain terms?

A sandbox is a locked room Windows puts risky code in, like a browser tab, so that if that code is malicious it cannot touch the rest of the machine. A sandbox escape is a bug that lets code pick the lock and walk out with full control. That is what makes this one worse than a typical local bug: it defeats a safety net you were counting on.

Do newer Windows 11 machines need this patch too?

Windows 11 is not on the affected list for CVE-2026-85880. It is affected by a separate exploited bug in the same September 2026 release, CVE-2026-81963, in the Windows Update Stack. If you run both new and old Windows machines, install this month’s cumulative update and reboot everything rather than sorting by version.

Where you stand

Not sure which of your machines are patched, rebooted, or quietly past end of life? Tell us a little about your environment and what is prompting the question, and we will come back with a fair, fixed quote for an internal test that maps it out. Request a quote.