Two bugs, one in Windows Update itself, let a program that is already on your PC take full control of it. Microsoft fixed it in the September 2026 Windows update. Any newer monthly update also includes the fix.
- Status
- Patched: update now
- Being attacked?
- Yes[3]
- Severity
- High
- Updated
CISA lists these as used in real attacks (added 2026-09-08). Microsoft's Security Update Guide marks them as exploited. Severity: Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked). First reported .
Am I affected?
You are at risk only if your Windows PC has not installed any monthly update since September 2026. Open Settings > Windows Update. If it says 'You're up to date', you are covered.
| App | Device | Affected | Fixed in |
|---|---|---|---|
| Windows 10 and 11 | Windows | Windows 10 and 11 PCs without the September 2026 security update or a newer one | Fixed by the September 2026 Windows security update (2026-09-08) or any newer monthly update. Microsoft's page lists the exact update for each Windows version.[1][2] |
How to check your version
These checks only look. They do not change anything on your computer.
Windows 10 and 11 on Windows
Easy way: Start > Settings > Windows Update. Then click Update history to see recent updates.
Or type this in PowerShellRead-only. It only reads the version and changes nothing.
Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn
How to fix it
- Open Start > Settings > Windows Update.
- Click Check for updates.
- Let the updates download and install.
- Restart your computer when it asks.
More on each app: Is my Windows up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/windows-attacked-bugs-sep-2026.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): CVE-2026-81963, CVE-2026-85880
Sources
- MakerMicrosoft Security Update Guide: CVE-2026-81963 (September 2026 update) (Sep 8, 2026)
- MakerMicrosoft Security Update Guide: CVE-2026-85880 (September 2026 update) (Sep 8, 2026)
- CISACISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-81963, CVE-2026-85880 (added 2026-09-08) (Sep 8, 2026)
- NVDNVD: CVE-2026-81963 (Sep 8, 2026)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.