Multiple Vulnerabilities in Microsoft Products · CIAD-2026-0044

CERT-In Advisory CIAD-2026-0044

Multiple Vulnerabilities in Microsoft Products

Original Issue Date: September 09, 2026

Severity Rating: High

Software Affected

Microsoft Windows Microsoft Office Microsoft Dynamics SQL Server Extended Security Updates (ESU) for legacy Microsoft products Azure Apps Developer Tools Open Source Software Server Software

Overview

Multiple vulnerabilities have been reported in Microsoft products that could allow an attacker to gain elevated privileges, obtain sensitive information, execute arbitrary code remotely, bypass security restrictions, conduct spoofing attacks, perform tampering of data or system processes, or cause denial-of-service (DoS) conditions.

Target Audience:

Individuals and IT administrators, security teams responsible for maintaining and updating Microsoft products.

Risk Assessment:

Risk of remote code execution, system instability or sensitive information disclosure.

Impact Assessment:

Potential compromise of system, exfiltration of data, ransomware attacks or system crashes.

Description

Multiple vulnerabilities have been reported in Microsoft products that could allow an attacker to gain elevated privileges, obtain sensitive information, execute arbitrary code remotely, bypass security restrictions, conduct spoofing attacks, perform tampering of data or system processes, or cause denial-of-service (DoS) conditions.

CVE-2026-81963 : This vulnerability exists in the Microsoft Windows Update Stack due to improper link resolution before file access. An authorized attacker could exploit this vulnerability locally to elevate privileges. Successful exploitation could result in elevated privileges on the affected system.

CVE-2026-85880 : This vulnerability exists in Microsoft Windows Advanced Local Procedure Call (ALPC) due to a heap-based buffer overflow. An authorized attacker could exploit this vulnerability locally to elevate privileges. Successful exploitation could result in elevated privileges on the affected system.

Note: These vulnerabilities are being exploited in the wild. Users are advised to apply patches immediately.

For complete list of affected products, CVEs, workarounds and solutions, refer to the Microsoft security updates. https://msrc.microsoft.com/update-guide/releaseNote/2026-Sep

Solution

Apply appropriate security updates as mentioned in https://msrc.microsoft.com/update-guide/releaseNote/2026-Sep

Vendor Information

Microsoft https://msrc.microsoft.com/update-guide/

References

https://msrc.microsoft.com/update-guide/releaseNote/2026-Sep