Microsoft's two exploited September flaws escalate a foothold an attacker already has

Dustin Childs of TrendAI's Zero Day Initiative doubts the automatic update process itself is compromised, and reads CVE-2026-81963 as something an attacker pairs with a code execution bug to spread malware or ransomware ^[6]. CrowdStrike puts the second zero-day in the same bracket, saying this class of flaw has historically appeared in post-compromise tooling used by commodity malware and by targeted intrusion operators, as a reliable final step from user-mode to kernel-mode control ^[8]. Both exploited bugs therefore need an attacker who already holds an account on the machine, which means the fixes raise the cost of the last step in an intrusion rather than the first ^[15].

Satnam Narang at Tenable counts seven privilege escalation flaws in the Windows Update Stack since 2022, and CVE-2026-81963 is the first of them to be exploited and the first to arrive as a zero-day ^[4]. The other six were patched without any public report of use ^[16]. Neither Microsoft's Threat Intelligence Centre, which reported the Update Stack flaw ^[5], nor Proofpoint, which reported the ALPC bug ^[7], has published the attacks.

ShieldCrash landed within hours of the fixes going live, with Nightmare Eclipse claiming a bypass of the patch for CVE-2026-69414, ShieldBreak, in the Microsoft Malware Protection Engine ^[2]. Help Net Security calls the bypass ostensible and reports no independent reproduction, and it does not date the ShieldBreak patch ^[17]. So the public clock runs hours from this month's release to the PoC appearing; it is not a measured interval from the Defender fix to a working bypass of it.

Reach this month sits with flaws nobody has been seen using. Childs flags a cluster of 20 bugs across most supported Windows versions where a remote, unauthenticated attacker gets arbitrary code execution with no user interaction ^[9], and singles out DNS flaw CVE-2026-69730 as the spiritual successor to SigRed, noting there has not been a global worm in years ^[10]. Kerberos authentication bypass CVE-2026-69676 is rated Exploitation More Likely, and Childs's read is one phished workstation account plus one crafted request equals code execution on a domain controller, which he calls a domain-compromise primitive ^[11]. CVE-2026-80093 in the Cloud Files Mini Filter Driver requires winning a race condition, and its technical details are already public ^[12].

Off the Windows rollup, Childs puts Exchange Server first, for a remote code execution flaw triggered when the server processes an email carrying a malicious Visio attachment, then SharePoint Server for an assortment of bugs ^[14].

A queue built on the known-exploited label alone patches two escalation primitives this week and leaves the DNS listener and the domain controller for the next window.