Two Exploited Windows Flaws Make September Updates Urgent
CISA added two Windows privilege-escalation flaws to its Known Exploited Vulnerabilities catalog on 8 September. Home users and organisations should install Microsoft's current security updates rather than assume antivirus or a VPN closes the holes.
The short version
What you need to know
- CISA added CVE-2026-81963 and CVE-2026-85880 to its exploited-vulnerability catalog on 8 September, confirming evidence of real-world exploitation without identifying victims or attack scale.
- Both flaws can raise an attacker's privileges locally; CISA specifically says the Windows Update Stack flaw can reach SYSTEM. That makes them important links in a wider attack chain rather than proof that any website can compromise a fully updated PC by itself.
- Install the current Windows security update, restart and confirm Windows Update reports completion. A VPN can protect network traffic but cannot repair a flaw in the operating system.
What CISA added to its exploited-vulnerability catalog
On 8 September, the US Cybersecurity and Infrastructure Security Agency added two Microsoft Windows vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-81963 is described as a link-following flaw in the Windows Update Stack, while CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call.
CISA says both can allow a local attacker to elevate privileges; it specifies SYSTEM-level access for CVE-2026-81963. Inclusion in the catalog means there is evidence of exploitation in the wild, but the entries do not name victims, describe the delivery method or say how widespread the activity is. They also list ransomware use as unknown.
Why local privilege escalation still matters
A local privilege-escalation flaw normally needs an attacker to gain some access to the computer first, for example through malicious software, a compromised account or another vulnerability. It is not the same as an unauthenticated remote flaw that can be triggered against any reachable PC.
The risk is what happens next. Moving from a restricted account to SYSTEM can give an attacker much greater control over files, security settings, credentials and persistence. That is why defenders treat these bugs as useful links in a multi-step attack even when they are not the initial entry point.
What Windows users should do now
Open Settings, go to Windows Update and install the current security updates offered for your supported version of Windows. Restart when prompted, then return to Windows Update and confirm there is no failed or pending security installation. Managed work devices should follow the organisation's update process rather than bypassing controls.
Do not rely on the update alone after credible signs of compromise. Unexpected administrator accounts, disabled security tools, unfamiliar remote-access software or confirmed malware require incident-response checks as well as patching. Keep browsers and other applications current, avoid untrusted installers and use a standard user account for everyday work where practical.
Where a VPN helps — and where it does not
A reputable full-tunnel VPN can encrypt supported traffic between a device and the VPN provider and reduce what a local network or internet provider sees directly. That remains useful on shared or untrusted networks.
A VPN cannot change the vulnerable Windows code, remove malware that already has local access, block every route by which an attacker might reach a PC or confirm that an update installed correctly. Operating-system updates, endpoint protection, limited privileges and investigation of suspicious activity address this warning more directly.
VPN Rocks view
The important phrase in CISA's notice is not simply zero-day; it is known exploitation. Users do not need to guess whether every Windows machine was targeted, but they should treat the current update as routine maintenance that has become time-sensitive.
This is also a useful boundary for security marketing. Encrypted traffic and a changed public IP address do not make an unpatched operating system safe. Keep the network layer and the device layer protected separately.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.
