Have exploitation attempts been observed for CVE-2026-85880?

Yes. Exploitation attempts have been reported for this vulnerability. Previdian lists CVE-2026-85880 as a known exploited vulnerability. Confidence is confirmed.

What exploitation activity has Previdian observed?

Previdian has not yet recorded sensor-observed exploitation attempts for CVE-2026-85880. Our sensors continue to monitor for activity targeting this CVE.

Which versions are affected?

CVE-2026-85880 affects Microsoft Windows 10 Version 1607 and 12 other products. Previdian lists 13 version rows; examples include 10.0.14393.0 to < 10.0.14393.9512, 10.0.17763.0 to < 10.0.17763.9245, and 10.0.19044.0 to < 10.0.19044.7725.

Yes. CVE-2026-85880 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Added to Previdian from a trusted third-party report 1 hour before CISA listed it.

Vulnerability report

Exploitation attempts observed in the wild Confirmed confidence In CISA KEV

CVE-2026-85880

Q: What is CVE-2026-85880?

CVE-2026-85880 is a vulnerability affecting Microsoft Windows 10 Version 1607 and 12 other products. Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Q: How should organizations remediate it?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Q: Is it in CISA KEV?

Yes. CVE-2026-85880 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Added to Previdian from a trusted third-party report 1 hour before CISA listed it.

Windows 10 Version 1607

Microsoft / Windows 10 Version 1607 · affected before 10.0.14393.9512

Watch CVE-2026-85880 Browse KEV feed

Severity: CVSS 7.8 · High
Confidence: Confirmed
Exploit status: Exploitation attempts observed in the wild
EPSS: 0.4%
First observed: —
Last observed: —

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-85880 is a vulnerability affecting Microsoft Windows 10 Version 1607 and 12 other products. Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Have exploitation attempts been observed?

Yes. Exploitation attempts have been reported for this vulnerability. Previdian lists it as a known exploited vulnerability. Listed in CISA KEV. Also reported by third-party sources. Confidence is confirmed.

Who is affected?

Microsoft / Windows 10 Version 1607 affected before 10.0.14393.9512.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Vendor Product Affected Status

Microsoft Affected

Windows 10 Version 1607

Before 10.0.14393.9512

Affected

Microsoft Affected

Windows 10 Version 1809

Before 10.0.17763.9245

Affected

Microsoft Affected

Windows 10 Version 21H2

Before 10.0.19044.7725

Affected

Microsoft Affected

Windows 10 Version 22H2

Before 10.0.19045.7725

Affected

Microsoft Affected

Windows Server 2012

Before 6.2.9200.26349

Affected

Microsoft Affected

Windows Server 2012 (Server Core installation)

Before 6.2.9200.26349

Affected

Microsoft Affected

Windows Server 2012 R2

Before 6.3.9600.23398

Affected

Microsoft Affected

Windows Server 2012 R2 (Server Core installation)

Before 6.3.9600.23398

Affected

Microsoft Affected

Windows Server 2016

Before 10.0.14393.9512

Affected

Microsoft Affected

Windows Server 2016 (Server Core installation)

Before 10.0.14393.9512

Affected

Microsoft Affected

Windows Server 2019

Before 10.0.17763.9245

Affected

Microsoft Affected

Windows Server 2019 (Server Core installation)

Before 10.0.17763.9245

Affected

Microsoft Affected

Windows Server 2022

Before 10.0.20348.5622

Affected

View vendor advisory

Published: 08 Sep 2026
Exploitation Attempts Reported: 08 Sep 2026
Attack vector: Local
Complexity: Low
Privileges: Low
User interaction: None

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-85880
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability msrc.microsoft.com · Vendor Advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880

Exploitation evidence

Evidence of exploitation attempts

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploitation attempts observed in the wild

Tenable Blog

Recorded 08 Sep 2026

A trusted third party reported exploitation attempts.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access

Source	Added
Microsoft CVRF First	2026-09-08 07:00 UTC
Tenable Blog	2026-09-08 18:07 UTC
CISA	2026-09-08 18:40 UTC
CVE	2026-09-08 19:01 UTC
CyberInsider	2026-09-08 19:36 UTC
Rapid7	2026-09-08 21:44 UTC
The Hacker News	2026-09-23 08:31 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts: 0; 0; 0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

7.8 High

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

EPSS

0.4%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Heap-based Buffer Overflow CWE-122 Use of Uninitialized Resource CWE-908

Recent mention · The Hacker News

23 Sep 2026

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

Read full advisory

All Mentions

Recent mention · The Hacker News

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

The Hacker News · 23 Sep 2026

Ravie LakshmananSep 23, 2026Zero-Day / Vulnerability A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break out of the browser's sandbox and achieve remote code execution. "UTA0565 masqueraded as various entities including media organizations and a...

Recent mention · The Hacker News

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

The Hacker News · 15 Sep 2026

A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE. Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026. "The

Recent mention · TheRegister

Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits

TheRegister · 09 Sep 2026

Mind the patch gap, please and thank you

Recent mention · NCSC Security Advisories

NCSC-2026-0353 [1.01] [M/H] Kwetsbaarheden verholpen in Microsoft Windows

NCSC Security Advisories · 09 Sep 2026

Microsoft heeft 666 kwetsbaarheden verholpen in Windows. Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade, zoals genoemd in onderstaande tabel. Microsoft heeft voor Windows 666 kwetsbaarheden verholpen. De 32 ernstigste kwetsbaarheden bevinden zich in meerdere Windows componenten en hebben een CVSS score van 9.0 en hoger toegewezen gekregen. Kwaadwillenden met toegang tot deze componenten kunnen zonder voorafgaande authenticatie mogelijk code uitvoeren of zich toegang verschaffen tot het kwetsbare systeem. Deze...

Recent mention · TheRegister

Microsoft breaks Patch Tuesday record with 974-CVE deluge

TheRegister · 09 Sep 2026

Adobe also brought goodies to the patch party and they deserve immediate attention

Recent mention · Cisco Talos Blog

Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

Cisco Talos Blog · 08 Sep 2026

Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical."

Recent mention · Rapid7

Patch Tuesday - September 2026

Rapid7 · 08 Sep 2026

Microsoft is publishing 974 own-product vulnerabilities on September 2026 Patch Tuesday, including 723 vulnerabilities in Windows. Along with Microsoft fixes for 25 non-Microsoft CVEs, that brings the total number of vulnerabilities on the table today to 999. Whether this is the biggest Patch Tuesday ever depends on how we count, but this is by far the most CVEs that Microsoft has ever published in a single day. As Rapid7 noted last month, there is no reason to suppose that Patch Tuesday will ever return to the lower volumes we saw prior to 2026. Microsoft is aware of exploitation in the...

Recent mention · CyberInsider

Microsoft releases Windows security update addressing 723 flaws

CyberInsider · 08 Sep 2026

Microsoft has released its September 2026 security updates, fixing two Windows elevation-of-privilege vulnerabilities that attackers are already exploiting in the wild. The company’s broader Patch Tuesday release addresses 974 CVEs across its products, including 723 affecting Windows. The two actively exploited flaws are tracked as CVE-2026-85880 and CVE-2026-81963. Microsoft says neither vulnerability was publicly disclosed … The post Microsoft releases Windows security update addressing 723 flaws appeared first on CyberInsider.

Recent mention · Tenable Blog

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Tenable Blog · 08 Sep 2026

104Critical860Important0Moderate0LowMicrosoft addresses 964 CVEs, smashing July’s release as the largest Patch Tuesday release. This month’s updates include patches for two zero-days that were exploited in the wild.Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated as important.This month’s update includes patches for:.NET.NET and Visual StudioASP.NET CoreActive Directory Certificate Services (AD CS)Active Directory Domain ServicesActive Directory Federation Services (AD FS)Audio Video Control Transport ProtocolAzure...

Timeline

From disclosure to observed exploitation attempts

23 Sep 2026
08:31 UTC

KEV confirmed by The Hacker News

Exploitation attempts reported by an external source
08 Sep 2026
21:44 UTC

KEV confirmed by Rapid7

Exploitation attempts reported by an external source
08 Sep 2026
19:36 UTC

KEV confirmed by CyberInsider

Exploitation attempts reported by an external source
08 Sep 2026
19:01 UTC

KEV confirmed by CVE

Exploitation attempts reported by an external source
08 Sep 2026
18:40 UTC

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
08 Sep 2026
18:07 UTC

KEV confirmed by Tenable Blog

Exploitation attempts reported by an external source
08 Sep 2026
17:14 UTC

CVE published

Vulnerability disclosed publicly
08 Sep 2026
07:00 UTC

Added to Previdian KEV Feed

High-confidence, third-party report of exploitation attempts
04 Sep 2026
18:18 UTC

CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-85880

Sample API response

{
  "cve_id": "CVE-2026-85880",
  "confidence": "Confirmed",
  "cvss_score": 7.8,
  "cvss_estimated": false,
  "epss_score": 0.00387,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}

CVE-2026-85880

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally

Tags

CVE References

Exploitation attempts observed in the wild

Known exploited vulnerability sources

Observed signals

Scanner coverage

Virtual patch status

Weaknesses

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

All Mentions

KEV confirmed by The Hacker News

KEV confirmed by Rapid7

KEV confirmed by CyberInsider

KEV confirmed by CVE

Added to CISA KEV

KEV confirmed by Tenable Blog

CVE published

Added to Previdian KEV Feed

CVE ID reserved

Automate this intelligence