🛡️ CVE-2026-85880

The items that name it 3

• Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Chrome/Windows Zero-Day Chain
  writeup2026-09-09

  Windows kernel Local Privilege Escalation (LPE) zero-day present in older Windows builds, exploited via ALPC- and Windows Notification Facility (WNF)-based technique to obtain kernel read/write and enable SeDebugPrivilege in the renderer's token, used to escape the Chrome renderer process. Part of t

• Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
  advisory2026-09-08
• Patch Tuesday - September 2026
  advisory2026-09-08It is written here as CVE-2026-85880 (Windows ALPC elevation of privilege; exploited in the wild; CVSS v3 7.8; buffer overflow / out-of-bounds write leading to SYSTEM; not patched for Server 2025 or Windows 11).

  Windows ALPC elevation of privilege; exploited in the wild; CVSS v3 7.8; buffer overflow / out-of-bounds write leading to SYSTEM; not patched for Server 2025 or Windows 11