Is CVE-2026-85880 actively exploited?

Yes. Previdian tracks CVE-2026-85880 as a known exploited vulnerability. Confidence is confirmed.

What exploitation activity has Previdian observed?

Previdian has not yet recorded sensor-observed exploitation attempts for CVE-2026-85880. Our sensors continue to monitor for activity targeting this CVE.

Which versions are affected?

CVE-2026-85880 affects Microsoft Windows 10 Version 1607 and 12 other products. Previdian lists 13 version rows; examples include 10.0.14393.0 to < 10.0.14393.9512, 10.0.17763.0 to < 10.0.17763.9245, and 10.0.19044.0 to < 10.0.19044.7725.

Yes. CVE-2026-85880 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Previdian attested it 12 hours ahead of CISA.

CVE-2026-85880 Exploited in the Wild — Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022

Q: What is CVE-2026-85880?

CVE-2026-85880 is a vulnerability affecting Microsoft Windows 10 Version 1607 and 12 other products. Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Q: How should organizations remediate it?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Q: Is it in CISA KEV?

Yes. CVE-2026-85880 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Previdian attested it 12 hours ahead of CISA.

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-85880 is a vulnerability affecting Microsoft Windows 10 Version 1607 and 12 other products. Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Is it exploited?

Yes. Previdian tracks this CVE as a known exploited vulnerability. Confidence is confirmed. Listed in CISA KEV. Also confirmed by third-party sources.

Who is affected?

Microsoft / Windows 10 Version 1607 affected before 10.0.14393.9512.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Vendor Product Affected Status

Microsoft Windows 10 Version 1607 Before 10.0.14393.9512 Affected

Microsoft Windows 10 Version 1809 Before 10.0.17763.9245 Affected

Microsoft Windows 10 Version 21H2 Before 10.0.19044.7725 Affected

Microsoft Windows 10 Version 22H2 Before 10.0.19045.7725 Affected

Microsoft Windows Server 2012 Before 6.2.9200.26349 Affected

Microsoft Windows Server 2012 (Server Core installation) Before 6.2.9200.26349 Affected

Microsoft Windows Server 2012 R2 Before 6.3.9600.23397 Affected

Microsoft Windows Server 2012 R2 (Server Core installation) Before 6.3.9600.23397 Affected

Microsoft Windows Server 2016 Before 10.0.14393.9512 Affected

Microsoft Windows Server 2016 (Server Core installation) Before 10.0.14393.9512 Affected

Microsoft Windows Server 2019 Before 10.0.17763.9245 Affected

Microsoft Windows Server 2019 (Server Core installation) Before 10.0.17763.9245 Affected

Microsoft Windows Server 2022 Before 10.0.20348.5622 Affected

View vendor advisory

Published: 08 Sep 2026
Exploitation Reported: 08 Sep 2026
Attack vector: Local
Complexity: Low
Privileges: Low
User interaction: None

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-85880
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability msrc.microsoft.com · Vendor Advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880

Exploitation evidence

Why Previdian marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

Tenable Blog

Recorded 08 Sep 2026

Independent exploitation attestation added to the Previdian record.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access

Source	Added
Microsoft CVRF First	2026-09-08 07:00 UTC
Tenable Blog	2026-09-08 18:07 UTC
CISA	2026-09-08 18:40 UTC
CVE	2026-09-08 19:01 UTC
CyberInsider	2026-09-08 19:36 UTC
Rapid7	2026-09-08 21:44 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts: 0; 0; 0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

7.8 High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

EPSS

0.6%

Weaknesses

Heap-based Buffer Overflow CWE-122 Use of Uninitialized Resource CWE-908

Recent mention · NCSC Security Advisories

NCSC-2026-0353 [1.01] [M/H] Kwetsbaarheden verholpen in Microsoft Windows

Microsoft heeft 666 kwetsbaarheden verholpen in Windows. Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade, zoals genoemd in onderstaande tabel. Microsoft heeft voor Windows 666 kwetsbaarheden verholpen....

Read full advisory

All Mentions

Recent mention · NCSC Security Advisories

NCSC-2026-0353 [1.01] [M/H] Kwetsbaarheden verholpen in Microsoft Windows

NCSC Security Advisories · 09 Sep 2026

Microsoft heeft 666 kwetsbaarheden verholpen in Windows. Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade, zoals genoemd in onderstaande tabel. Microsoft heeft voor Windows 666 kwetsbaarheden verholpen. De 32 ernstigste kwetsbaarheden bevinden zich in meerdere Windows componenten en hebben een CVSS score van 9.0 en hoger toegewezen gekregen. Kwaadwillenden met toegang tot deze componenten kunnen zonder voorafgaande authenticatie mogelijk code uitvoeren of zich toegang verschaffen tot het kwetsbare systeem. Deze...

Recent mention · TheRegister

Microsoft breaks Patch Tuesday record with 974-CVE deluge

TheRegister · 09 Sep 2026

Adobe also brought goodies to the patch party and they deserve immediate attention

Recent mention · Cisco Talos Blog

Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

Cisco Talos Blog · 08 Sep 2026

Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical."

Recent mention · Rapid7

Patch Tuesday - September 2026

Rapid7 · 08 Sep 2026

Microsoft is publishing 974 own-product vulnerabilities on September 2026 Patch Tuesday, including 723 vulnerabilities in Windows. Along with Microsoft fixes for 25 non-Microsoft CVEs, that brings the total number of vulnerabilities on the table today to 999. Whether this is the biggest Patch Tuesday ever depends on how we count, but this is by far the most CVEs that Microsoft has ever published in a single day. As Rapid7 noted last month, there is no reason to suppose that Patch Tuesday will ever return to the lower volumes we saw prior to 2026. Microsoft is aware of exploitation in the...

Recent mention · CyberInsider

Microsoft releases Windows security update addressing 723 flaws

CyberInsider · 08 Sep 2026

Microsoft has released its September 2026 security updates, fixing two Windows elevation-of-privilege vulnerabilities that attackers are already exploiting in the wild. The company’s broader Patch Tuesday release addresses 974 CVEs across its products, including 723 affecting Windows. The two actively exploited flaws are tracked as CVE-2026-85880 and CVE-2026-81963. Microsoft says neither vulnerability was publicly disclosed … The post Microsoft releases Windows security update addressing 723 flaws appeared first on CyberInsider.

Recent mention · Tenable Blog

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Tenable Blog · 08 Sep 2026

104Critical860Important0Moderate0LowMicrosoft addresses 964 CVEs, smashing July’s release as the largest Patch Tuesday release. This month’s updates include patches for two zero-days that were exploited in the wild.Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated as important.This month’s update includes patches for:.NET.NET and Visual StudioASP.NET CoreActive Directory Certificate Services (AD CS)Active Directory Domain ServicesActive Directory Federation Services (AD FS)Audio Video Control Transport ProtocolAzure...

Timeline

From disclosure to observed exploitation

08 Sep 2026
KEV confirmed by Rapid7

Exploitation attested by an external source
08 Sep 2026
KEV confirmed by CyberInsider

Exploitation attested by an external source
08 Sep 2026
KEV confirmed by CVE

Exploitation attested by an external source
08 Sep 2026
Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
08 Sep 2026
KEV confirmed by Tenable Blog

Exploitation attested by an external source
08 Sep 2026
CVE published

Vulnerability disclosed publicly
08 Sep 2026
Added to Previdian KEV Feed

High-confidence, third-party attested exploitation
04 Sep 2026
CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro pricing Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-85880

Free JSON includes basic KEV fields

{
  "cve_id": "CVE-2026-85880",
  "confidence": "Confirmed",
  "cvss_score": 7.8,
  "cvss_estimated": false,
  "epss_score": 0.00572,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}

CVE-2026-85880

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally

Tags

CVE References

Exploited in the wild

Known exploited vulnerability sources

Observed signals

Scanner coverage

Virtual patch status

Weaknesses

NCSC-2026-0353 [1.01] [M/H] Kwetsbaarheden verholpen in Microsoft Windows

All Mentions

KEV confirmed by Rapid7

KEV confirmed by CyberInsider

KEV confirmed by CVE

Added to CISA KEV

KEV confirmed by Tenable Blog

CVE published

Added to Previdian KEV Feed

CVE ID reserved

Automate this intelligence