Two exploited Windows privilege escalations should go first in September's record Patch Tuesday

Both bugs score CVSS 7.8, which looks minor on a page of 9.8s ^[3][4]. A local escalation needs the attacker to already run code on the machine. The post places this kind of flaw as the second half of most intrusion chains. An attacker gets low-privilege code running through a phishing document, a browser exploit or a compromised service, then uses the escalation to reach SYSTEM ^[7]. From there the attacker disables defenses, installs persistence and moves laterally ^[7].

CVE-2026-85880 widens where that second half can start. Reporting cited in the post says it can be used to escape a low-privilege AppContainer sandbox ^[5]. On an unpatched machine, code confined to a sandbox has the same route to SYSTEM as code running in a normal user session ^[2][5]. The post does not describe either exploit beyond its weakness class: CWE-59 link following for the Update Stack bug, CWE-787 heap buffer overflow for ALPC ^[3][4].

The post ranks the month in three tiers. Confirmed-exploited flaws go first. Pre-authentication, network-reachable RCE on internet-facing services goes second. Everything else follows on a risk-based schedule ^[14]. I think that is the right order for a fleet of workstations and internal servers, where phishing and browser footholds are the likely first step ^[7].

It transfers less cleanly to an organization that exposes DNS Server, RDP, RRAS, SSTP or the print provider to the internet. Those are the 9.8 services an external attacker can reach ^[16]. ZDI reportedly classed around 20 of the month's fixes as potentially wormable, meaning pre-authentication and zero-interaction ^[11]. For that organization the first two tiers are both urgent, and I would staff them in parallel.

Exchange needs its own track. CVE-2026-55007 is a use-after-free that, according to reporting in the post, fires when the server processes an email carrying a malicious Visio attachment. The recipient never has to open it ^[10]. The post says a mail-triggered bug like this bypasses most user-awareness training and needs a faster timeline than the general cycle ^[15]. With on-premises Exchange receiving external mail, I would patch it alongside the two escalations.

CISA's catalog entry gave federal agencies 14 days ^[1]. The post's advice for the two escalations is to patch them first and then check that the update actually applied ^[18].

The monthly count is less settled than the record label suggests. Published tallies range from roughly 966 to 997, depending on how Chromium and third-party components are counted ^[1]. The gap between those tallies, 31 CVEs, is more than 15 times the length of the list that has to go first ^[2].