CISA’s September 8 alert lists CVE-2026-81963, a Windows Update Stack link-following vulnerability, and CVE-2026-85880, a heap-based buffer overflow in Windows Advanced Local Procedure Call, or ALPC. Microsoft marks both as exploited, and CISA’s KEV inclusion means the agency has evidence of active exploitation—not merely a prediction that exploitation is likely.
The four additions do not describe one campaign or a common exploit chain. They span desktop and server Windows, e-commerce platforms exposed to the internet, and a remote monitoring and management platform used by managed service providers. The common factor is operational: each has a vendor fix available, and attackers have already crossed the threshold that turns a patching backlog into an incident-response risk.
The Windows bugs require local access, but that does not make them low priority
CVE-2026-81963 affects the Windows Update Stack and is a link-following flaw—an error in how a privileged component resolves a file-system link before accessing a file. Microsoft’s vulnerability record describes exploitation as requiring an authorized attacker with local access, but successful exploitation can elevate privileges to SYSTEM. Tenable’s Patch Tuesday analysis likewise identifies it as a Windows Update Stack elevation-of-privilege zero-day with a 7.8 CVSS score.
The affected Windows branches published in Microsoft’s security data are unusually narrow compared with a typical all-versions Windows flaw. They include Windows 11 23H2, 24H2, 25H2, and 26H1, plus Windows Server 2025. The minimum patched builds are:
- Windows 11 23H2 is fixed at build 22631.7582.
- Windows 11 24H2 is fixed at build 26100.9445.
- Windows 11 25H2 is fixed at build 26200.9445.
- Windows 11 26H1 is fixed at build 28000.2954.
- Windows Server 2025 is fixed at build 26100.33438.
The client updates associated with the flaw include KB5122880 for Windows 11 23H2, KB5124008 for Windows 11 24H2 and 25H2, and KB5124012 for Windows 11 26H1. Windows Server 2025 is mapped to KB5122871. Organizations should validate the resulting build number, not simply record that a September cumulative update was offered or downloaded.
CVE-2026-85880 is a different local elevation-of-privilege problem in Windows ALPC, a core Windows interprocess-communication facility. The bug is a heap-based buffer overflow and, like CVE-2026-81963, requires an authorized attacker to run code locally with low privileges. Its published CVSS vector rates confidentiality, integrity, and availability impact as high after exploitation, with no user interaction required.
Unlike the Windows Update Stack vulnerability, the ALPC issue reaches further into older Windows estates. Microsoft’s published affected-product data includes Windows 10 21H2 and 22H2, Windows Server 2012 and 2012 R2, Windows Server 2016, Windows Server 2019, and Windows Server 2022. Fixed builds include 19045.7725 for Windows 10 22H2, 17763.9245 for Windows Server 2019, and 20348.5622 for Windows Server 2022. The related cumulative updates include KB5122878 for Windows 10, KB5122876 for Windows Server 2019, and KB5122882 for Windows Server 2022.
Neither Windows vulnerability is described as a remote-code-execution issue. That distinction should shape triage, not defer it. An attacker still needs a foothold—through malware, a malicious local account, a compromised remote-access session, or another application flaw—but a reliable route from a low-privilege context to SYSTEM can defeat endpoint controls, persistence boundaries, and some containment assumptions.
For IT teams, the useful response is to identify systems where untrusted code can execute or lower-privileged users can log on: shared workstations, Remote Desktop Session Host servers, virtual desktop pools, developer endpoints, kiosks, and servers with broad operational access. Patch those first, and investigate unusual privilege changes, unexpected scheduled tasks, service creation, tampering with update-related directories, and endpoint telemetry showing suspicious child processes from standard user contexts.
Adobe’s CVSS 10 flaw is the externally exposed emergency
CVE-2026-75650 is the most urgent of the four additions for organizations operating an exposed web application. Adobe’s September 7 bulletin, APSB26-146, describes an improper-neutralization flaw in the template engine of Adobe Commerce and Magento Open Source that can result in arbitrary code execution. Adobe assigns it a CVSS 3.1 score of 10.0 and says exploitation requires no authentication.
Adobe says versions through the August 2026 releases are affected across Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The company issued a dedicated hotfix for CVE-2026-75650 and gave it Priority 1 status, its highest deployment urgency classification. Adobe separately released its regular September Commerce security bulletin on September 8 and explicitly instructed customers to apply the CVE-2026-75650 hotfix in addition to that month’s broader update.
That sequencing matters. Applying the September feature or security release alone should not be assumed to remediate the exploited flaw unless the installation has also received the dedicated hotfix Adobe identifies for CVE-2026-75650. Commerce administrators should verify both the installed product release and hotfix state, then examine web-server, application, and administrative logs for activity preceding remediation.
The practical risk is not limited to storefront disruption. An unauthenticated code-execution flaw on an e-commerce platform can expose customer data, payment-adjacent infrastructure, order information, administrative credentials, and integrations that connect the store to ERP, fulfillment, or marketing systems. CISA has not publicly attributed the observed exploitation or provided a victim count, so organizations should avoid assuming that only a known campaign or a particular hosting model is in scope.
N-central’s vendor statement now conflicts with CISA’s exploitation finding
The fourth KEV addition, CVE-2026-86218, affects N-able N-central before version 2026.3.1.14. N-central is a remote monitoring and management platform, which makes the location of the flaw more significant than its generic CWE label suggests: an attacker able to execute code on the management server may be positioned near tools used to administer many downstream customer or enterprise devices.
N-able’s September 6 Hotfix 4 announcement says the static-code-injection issue can permit pre-authentication remote code execution on the N-central server. The vendor assigns it a CVSS 4.0 score of 10.0 and directs self-hosted customers to upgrade immediately to build 2026.3.1.14. N-able also says its hosted N-central customers require no action because it has already applied the patches, while the security fix does not require an agent upgrade.
There is a material change in the public record between N-able’s initial notice and CISA’s September 8 KEV action. N-able’s Hotfix 4 post said it had no confirmation that the vulnerability had been exploited in production environments. CISA then added the CVE to KEV based on evidence of active exploitation. Canada’s Cyber Centre and NHS England have also issued alerts describing the issue as exploited or potentially exploited in the wild.
That does not prove N-able withheld a confirmed incident. The company’s statement was published September 6, while CISA’s KEV addition followed on September 8. But the vendor’s public status notice has not reconciled its earlier “no confirmations” language with the later government exploitation finding, and CISA has not disclosed victim numbers, indicators of compromise, or the observed intrusion path.
Self-hosted N-central operators should therefore do more than install HF4. They should review privileged administrator activity, automation-policy changes, remote-control sessions, newly created accounts, script execution history, and endpoint deployments made before the patch was installed. N-central’s role in managing downstream systems raises the consequence of a compromised server even where evidence of downstream misuse has not been publicly reported.
September 22 is the federal remediation deadline
CISA’s catalog entries set September 22, 2026, as the remediation deadline for federal civilian executive branch agencies. The alert cites Binding Operational Directive 26-04, which changes the federal emphasis from a universal patch clock toward risk-based handling, with particular attention to internet-exposed assets that could grant total control after exploitation and to forensic checks before patching in defined circumstances.
Private-sector organizations are not bound by that directive, but the split in these four vulnerabilities offers a useful priority order. Adobe Commerce and self-hosted N-central should move to the top of emergency maintenance queues because both are remotely exploitable server-side products, and their compromise can directly expose customers, transactions, or managed endpoints. Windows systems should receive the September cumulative updates on an accelerated schedule, with special attention to environments where attackers or untrusted users may already obtain local code execution.
The important operational conclusion is that patching closes the vulnerable path; it does not establish whether attackers used it before the update arrived. For the two Windows flaws, that means reviewing alerts associated with privilege escalation and SYSTEM-level persistence. For Commerce and N-central, it means retaining logs and checking administrative changes around the pre-patch period. By September 22, federal agencies must have remediated; every other organization should aim to have patched and completed its initial compromise triage well before that date.