Microsoft's 966-fix September Patch Tuesday closes two exploited zero-days with security updates

Three conditions have to hold at once for either bug to fire, according to the write-up: the machine has not taken the September 2026 updates, the attacker can already execute low-privilege code on it, and endpoint controls do not stop the resulting SYSTEM process ^[8]. Only the first is a project you can finish this week.

The published description of the bugs stops at the class. One is improper file-link resolution in the Update Stack ^[2]. The other is a heap buffer overflow in ALPC ^[3]. The write-up does not name an exploit primitive or an affected build list, and it discloses no follow-on activity; defense evasion, credential dumping, persistence and lateral movement are marked as inference rather than observation ^[14].

So detection gets built from behaviour rather than from the bug. The lead on offer is an anomalous elevation from a low-privilege process to SYSTEM followed by service creation, where endpoint auditing or EDR exists ^[20]. EDR is also the named source for file-link operations and service or task creation ^[13], and the guidance is to compare those process paths before and after patching ^[11]. A crash on the endpoint confirms only a failed attempt; establishing successful exploitation takes more evidence ^[13].

Now the scheduling arithmetic. Two exploited zero-days out of 966 fixes is 0.21 percent of the month ^[16]. The write-up lists no per-CVE workaround; the mitigation is the September 2026 update plus compensating controls ^[19]. So the exploited pair moves on the same schedule as the rest of the month's fixes. Advancing a ring to close CVE-2026-81963 and CVE-2026-85880 also ships the other 964 fixes ^[18] into that ring, with whatever regressions they carry. That cost belongs in the change record.

The urgency rests on exploitation status alone. The write-up is explicit that these flaws do not give an unauthenticated external attacker a way in ^[6], and that they do not remotely compromise a user merely because a link was opened, with the interaction requirements for initial access unknown ^[7]. The initial entry route is undisclosed ^[5]. It cites the MSRC pages for both CVEs and CISA's KEV catalog as related sources ^[17], which is where a due date, if one exists, would come from.

The write-up separates its evidence criteria from what has actually been observed, and labels its own inferences as inferences ^[15], which is rarer than it should be in vulnerability summaries.

For the hosts that cannot take a restart this week, the fallback is application control, least privilege and credential protection ^[10]. Those limit the foothold and the abuse of SYSTEM; they do not close the escalation. When the entry vector is unpublished, containment is the honest posture, and it should be logged as containment rather than counted as remediation.