Update Windows Now: Microsoft Fixes 2 Actively Exploited Zero-Days

Why should Windows users install the September 2026 security update now?

Microsoft’s September 2026 Windows security update deserves prompt installation because it fixes 2 vulnerabilities that were exploited before updates became available. Microsoft identified CVE-2026-81963 and CVE-2026-85880 as actively exploited vulnerabilities in its September 8 security release. Microsoft’s September 2026 security update notice confirms that both flaws were under attack before the patches were released.

The 2 flaws are elevation-of-privilege vulnerabilities. An elevation-of-privilege flaw does not necessarily give an attacker initial access to a computer, but it can allow an attacker who already has limited access to gain stronger permissions. That distinction matters because SYSTEM is one of the most powerful permission levels in Windows.

Windows users should install the update even when a device appears to work normally. Active exploitation means attackers have used the vulnerabilities in real attacks, rather than researchers identifying them only in a test environment. The practical response is to install available updates and restart the computer so Windows can complete the security changes.

Which Windows zero-days does the September update fix?

Microsoft’s September update fixes CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call, also known as ALPC. Both vulnerabilities are rated 7.8 on the Common Vulnerability Scoring System, or CVSS, according to Tenable’s analysis of Microsoft’s September release data. Tenable’s September Patch Tuesday analysis says successful exploitation of either flaw can elevate an attacker to SYSTEM privileges.

Windows Update Stack vulnerabilities are especially important because Windows Update is a core operating system service. Windows ALPC is a communication mechanism that lets Windows processes exchange information locally. The available research does not establish the exact attack chains used against every victim, so users should avoid assuming that one particular app, website, or attachment caused the risk.

Windows security incidents often involve several stages, including initial access and privilege escalation. A separate browser flaw can create another point of exposure, which is why users should also install Chrome security updates when Google makes them available.

What does SYSTEM access mean for a Windows PC?

SYSTEM access gives an attacker unusually broad control over a Windows PC because the SYSTEM account has deeper operating system permissions than a standard user account. Tenable says successful exploitation of CVE-2026-81963 or CVE-2026-85880 can elevate an attacker to SYSTEM privileges. That level of access can make it easier for an attacker to interfere with security controls or manipulate protected parts of Windows.

The most important point is that these flaws are privilege-escalation vulnerabilities, not a complete description of how an attacker reaches a device. A Windows user should still treat the update as urgent because privilege escalation can turn a smaller compromise into a more serious system-level incident.

Windows users should not attempt to disable Windows services, edit the registry, or alter system permissions to work around the vulnerabilities. Those actions do not replace Microsoft’s patch and can create stability or recovery problems. Install the security update first, then investigate further only if security software, an employer, or a trusted support provider identifies a specific issue.

Which Windows versions receive KB5124008?

Windows 11 versions 24H2 and 25H2 receive KB5124008, which updates the operating system to builds 26100.9445 and 26200.9445, respectively. Microsoft’s KB5124008 documentation states that the update contains security improvements and is available through Windows Update.

KB5124008 installs automatically through Windows Update, although the installation and restart can depend on a device’s update settings and current state. Microsoft also provides standalone x64 and Arm64 packages through the Microsoft Update Catalog. For most home users, Windows Update is the more sensible route because it selects the applicable package for the device.

Windows hardware varies widely, from conventional laptops to new compact Windows systems. That variation does not change the need to patch supported Windows 11 installations, but it can affect when a restart is convenient. Save open work before beginning the update process.

How do you install the Windows security update safely?

Windows users can install the September security update through Settings > Windows Update. The update is designed to install automatically, but manually checking for updates can confirm whether KB5124008 is ready for the device. Save open files before restarting because the installation requires Windows to apply system changes.

1. Open Settings on the Windows 11 PC.
2. Select Windows Update in the left-side menu.
3. Select Check for updates and allow Windows to search for available updates.
4. Select Download and install if KB5124008 appears.
5. Restart the PC when Windows requests it, after saving your work.

Windows Update is the preferred method for most users because Microsoft lists KB5124008 as an automatic Windows Update release. The standalone x64 and Arm64 packages are available for situations where Windows Update is not the chosen deployment method, but manual package installation is not necessary for a typical personal PC.

Stop and contact your PC maker’s support team or an employer’s IT administrator if the update repeatedly fails, the computer cannot restart normally, or the device is managed by an organization. Do not change BIOS or UEFI settings, modify partitions, or use registry fixes to force the update. Those actions can create data-loss or boot problems that the security update does not require.

What other problems does KB5124008 address?

KB5124008 also fixes black desktop backgrounds, custom mouse-pointer colors that do not display, and unexpected Microsoft Teams and Outlook closures on Arm64 PCs. Microsoft lists those fixes in the KB5124008 release documentation. The nonsecurity fixes matter because they address visible desktop and productivity issues that some users may have experienced alongside the security improvements.

Microsoft says it is not currently aware of issues with KB5124008. That statement is useful, but it does not guarantee that every hardware and software combination will behave identically after installation. Windows PCs can have different drivers, security software, peripherals, and management settings that affect update behavior.

Windows users who depend on custom pointer colors or Arm64 productivity apps should still install the update rather than delay it for those quality-of-life fixes alone. The actively exploited security flaws are the central reason to patch. Users considering a new Windows system can also weigh repairability and support features when comparing devices such as the repairable Acer Vero 16.

How large was Microsoft’s September 2026 security release?

Microsoft’s September 2026 release addressed 964 CVEs, including 104 rated Critical and 860 rated Important, based on Tenable’s count of Microsoft’s release data. The size of the release shows that the 2 actively exploited Windows flaws were part of a broader monthly patch cycle affecting Microsoft products and services.

The number of vulnerabilities does not mean every Windows user faces the same exposure. A vulnerability matters to a specific device only when the affected product, version, feature, or configuration is present. The 2 exploited elevation-of-privilege flaws remain a priority because Microsoft confirmed exploitation before the fixes were available.

For most users, the practical approach is routine patching rather than trying to evaluate hundreds of CVEs individually. Install the available Windows update, keep browsers and security software current, and be cautious with unexpected downloads and login prompts. Security updates are most effective when they are applied before a known vulnerability can be used against the device.

What should you do if Windows Update will not install KB5124008?

Windows users should first retry Windows Update and restart the PC if KB5124008 does not install on the first attempt. Microsoft provides standalone x64 and Arm64 packages through the Microsoft Update Catalog, but most users do not need to use them when Windows Update is functioning normally. The Microsoft support documentation identifies both package types for the September release.

Windows Update failures can have different causes, and the supplied update information does not identify a single cause for every installation problem. Avoid downloading update packages from unofficial file sites because a Windows update package should come from Microsoft. A legitimate update source matters because attackers can use convincing file names to disguise malicious downloads.

Stop and seek help from Microsoft, the PC manufacturer, or an organization’s IT administrator if repeated installation attempts fail or the computer begins showing startup problems. Back up important files before any advanced recovery procedure. A failed update is frustrating, but unverified repair tools and unsupported system changes can create a more serious problem.

FAQ

Are CVE-2026-81963 and CVE-2026-85880 actively exploited?

Yes, Microsoft said CVE-2026-81963 and CVE-2026-85880 were exploited before the September 8, 2026, updates became available. Both flaws should be treated as a prompt patching priority for supported Windows devices.

What is KB5124008?

KB5124008 is the September 2026 Windows 11 security update for versions 24H2 and 25H2. Microsoft says the update includes security improvements and also fixes several desktop and Arm64 application issues.

Does KB5124008 install automatically?

Yes, Microsoft says KB5124008 installs automatically through Windows Update. Windows users can also open Settings > Windows Update and manually check whether the update is available.

What happens if an attacker gets SYSTEM privileges?

SYSTEM privileges give an attacker broad control over a Windows device. The exact impact depends on the rest of the attack chain, but SYSTEM-level access can make a compromise substantially more serious.

Should you use the Microsoft Update Catalog instead?

No, most home users should use Windows Update because Microsoft distributes KB5124008 there automatically. Use the Microsoft Update Catalog only when a managed deployment or a specific support situation requires the standalone package.