CTI · reviewed · 2026-09-10

CISA Adds 4 Known Exploited Vulnerabilities to Catalog (September 8, 2026)

Full story & timeline

MITRE ATT&CK

• T1068 Exploitation for Privilege Escalation Privilege Escalation

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Windows Local Privilege Escalation via Known Exploited Vulnerabilities
id: 0b663248-bc48-4adb-abd4-4b3e24101ec3
status: experimental
description: Detects potential exploitation of Windows local privilege escalation vulnerabilities added to CISA KEV on September 8, 2026 (CVE-2026-81963, CVE-2026-85880). Both affect Windows Update Stack and ALPC subsystems.
references:
  - https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0908
  - https://yazoul.net
author: Tia N. List
date: 2026-09-10
tags:
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_alpc:
    Image|endswith: '\svchost.exe'
    CommandLine|contains: 'WerFault'
  selection_update_stack:
    Image|endswith: '\TiWorker.exe'
    IntegrityLevel: 'High'
  condition: selection_alpc or selection_update_stack
falsepositives:
  - Legitimate Windows Update operations
  - WerFault crash reporting
level: medium

References

• https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0908
• https://yazoul.net