Microsoft has published a security advisory on the CVE-2026-85880 vulnerability — a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) component. The vulnerability allows an authenticated local attacker to escalate privileges on the system. According to Microsoft’s metadata, exploitation of the vulnerability has already been observed. ALPC is an internal Windows kernel interprocess communication mechanism used by virtually all system services, which makes this vulnerability potentially dangerous for a wide range of Windows systems. Administrators are advised to check for security updates via Windows Update and apply them as a priority.
Technical details
The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow). According to the GitHub Advisory Database, the severity is assessed as High with a base score of CVSS v3 7.8. This indicates a high level of danger, though not critical: exploitation requires local access and authentication on the system.
ALPC (Advanced Local Procedure Call) is a high-performance interprocess communication (IPC) mechanism that operates at the Windows kernel level. It is used for message exchange between processes and underpins many system services, including RPC, COM, and the Task Scheduler. A heap overflow in this component allows an attacker to overwrite critical data structures in memory and achieve code execution with elevated privileges.
Key parameters of the vulnerability:
- Identifier: CVE-2026-85880
- Type: privilege escalation (Elevation of Privilege)
- Vulnerability class: CWE-122, heap-based buffer overflow
- CVSS v3: 7.8 (High)
- Attack vector: local, authentication required
- Exploitation status: Microsoft reports that exploitation has been detected
- Public disclosure before patch: no (according to Microsoft)
It is important to note that, at the time of publication, neither the Microsoft advisory nor the GitHub Advisory Database entry specify particular affected Windows versions or patch identifiers. This complicates an accurate assessment of the scope of the issue. The GitHub Advisory Database entry is dated 8 September 2026.
Exploitation status and threat assessment
The metadata of the Microsoft advisory includes the marks “Exploited: Yes” and “Exploitation Detected” for current software versions. However, it should be taken into account that, as of now, independent confirmation of active exploitation from other sources could not be obtained — the CISA KEV catalog was unavailable for verification at the time of analysis. No information on specific threat actors, campaigns, or indicators of compromise (IOC) is available in accessible sources.
Nevertheless, the very fact that Microsoft has marked the vulnerability as exploited is a serious signal. Privilege escalation vulnerabilities in Windows kernel components have traditionally been of high value to attackers: they are used at the post-exploitation stage to move from limited access to full control over the system. We have previously analyzed critical vulnerabilities in Microsoft products — for example, the remote code execution vulnerability in Microsoft Entra ID and the bypass of the Microsoft Defender patch, which points to a steady stream of serious security issues in the Windows ecosystem.
Impact assessment
ALPC is one of the fundamental mechanisms of the Windows kernel, involved in the operation of virtually every process. The vulnerability affects any organization using Windows systems, but the highest risk is for:
- Server environments — domain controllers, file servers, application servers, where privilege escalation can lead to compromise of the entire Active Directory infrastructure
- Workstations with multi-user access — terminal servers and virtual desktop (VDI) environments, where an authenticated user with limited rights can gain control over the system
- Environments that allow code execution by unprivileged users — including development and testing systems
If exploitation is successful, an attacker who already has limited access to the system can obtain SYSTEM-level privileges, opening up possibilities for installing malware, extracting credentials, moving laterally across the network, and disabling security tools.
Recommendations
Given Microsoft’s report of detected exploitation and the CVSS score of 7.8, the following course of action is recommended:
- Check for available security updates via Windows Update, WSUS, or SCCM. Since specific patch identifiers have not yet been published in accessible sources, you should monitor updates in the Microsoft Security Update Guide
- Prioritize patching of critical systems — domain controllers, servers with sensitive data, and systems accessible to a wide range of users
- Limit local access to servers and workstations: minimize the number of accounts with the right to log on locally, and review membership in the “Remote Desktop Users” group
- Strengthen monitoring — track anomalous privilege escalation attempts, creation of processes with SYSTEM level from the context of regular users, as well as suspicious activity related to ALPC ports
- Apply the principle of least privilege — ensure that service and user accounts do not have excessive rights
CVE-2026-85880 requires immediate attention from security teams: the combination of exploitation reported by Microsoft, the high CVSS score, and the criticality of the affected kernel component makes this vulnerability a patching priority. Until an update is available, local access to Windows systems should be restricted as much as possible and monitoring of privilege escalation events should be strengthened.
