Back to Blog

Four Nation-State Hacking Groups Were Using the Same Windows Exploit Chain Last Week. Patches Just Dropped.

Microsoft’s September 2026 Patch Tuesday dropped last week, and the headline number is hard to ignore: 974 vulnerabilities patched in one release.[1] That beats the previous record by a comfortable margin. But the raw count isn’t actually the story here. The story is two specific flaws that were being actively exploited before the patches arrived, by multiple government-backed hacking groups, using the same shared exploit kit.

If your Windows machines haven’t been updated since Monday, they’re still exposed to something that nation-state hackers were already using in real attacks.

The Two Zero-Days

Both are Windows privilege escalation flaws, both carry a CVSS score of 7.8, and both allow a local attacker to escalate their access all the way to SYSTEM—the highest privilege level on a Windows machine.[2]

CVE-2026-85880 is a heap-based buffer overflow in Windows ALPC, the Advanced Local Procedure Call subsystem that Windows uses for inter-process communication. An attacker who already has a foothold on the machine can exploit this to gain full control.[3]

CVE-2026-81963 is a link-following flaw in the Windows Update Stack itself. The component that installs your security updates has a bug that lets an attacker redirect file operations to take over the system.[2]

CISA added both to its Known Exploited Vulnerabilities catalog the same day the patches landed, September 8. Federal civilian agencies have until September 22 to apply the fixes.[4]

The BlueMoon Connection

Researchers at Proofpoint published a report called “Once in a BlueMoon” earlier this week that explains how these vulnerabilities fit into a larger attack picture.[5] BlueMoon is a shared exploit kit that chains three separate zero-days together. It starts with a Chrome browser vulnerability (CVE-2026-85046, a V8 type-confusion flaw) to get code execution inside the browser, then uses a second Chrome bug (CVE-2026-87491) to escape the browser sandbox, then uses the Windows ALPC overflow (CVE-2026-85880) to escalate to SYSTEM on the underlying machine.

The first observed use of this chain was attributed to APT31, a China-aligned espionage group also tracked as Violet Typhoon, on August 28.[5] Within about two weeks, Proofpoint identified four distinct espionage-motivated clusters all using the same exploit kit in targeted spearphishing campaigns. Four separate groups, different countries, different targets. Same tools.

This matters for a practical reason: when you hear “nation-state hackers,” it’s easy to assume they’re only going after government agencies and defense contractors. Sometimes that’s true. But the attack path here starts with phishing email, Chrome zero-day, Windows ALPC. That sequence works just as well against a small accounting firm or a medical practice as it does against a federal agency. The exploit doesn’t care about your revenue.

The Rest of the Update

Beyond the two zero-days, there are a few other fixes in this batch that smaller organizations should be aware of.

CVE-2026-55007 is a remote code execution flaw in Exchange Server. An unauthenticated attacker can send a specially crafted email containing a malicious Visio attachment and achieve code execution on the Exchange server itself without needing any credentials.[6] If you’re still running on-premises Exchange, this needs attention today.

There’s also CVE-2026-69465 in SharePoint (CVSS 8.8) that allows remote code execution over the network[6], and CVE-2026-65669 in SQL Server, rated 9.6, which lets an unauthenticated attacker escalate privileges over the network.[6] Zero Dray Initiative researchers noted there are also more than 20 “wormable” bugs in this release, meaning they could theoretically spread from machine to machine on a network without any user involvement.[7]

What to Actually Do This Week

Run Windows Update on every machine in your business. Start with servers if you have them. The two zero-days are in Windows components that every modern Windows version uses, so workstations need updates too, not just servers.

If you’re not sure whether your machines applied updates automatically on Tuesday, open Windows Update on a few and check. Look for the September 2026 cumulative update in the installed update history. If it’s there, you’re covered. If it’s not, something blocked it and you need to find out why.

The BlueMoon chain starts in the Chrome browser, so also check that Chrome is up to date. Google released patches for the two Chrome vulnerabilities used in BlueMoon alongside or just before Microsoft’s Tuesday release.[5] An unpatched Chrome is an open door even on a fully patched Windows machine.

On-prem Exchange customers need to prioritize the CVE-2026-55007 patch separately. The fact that a malicious Visio attachment in an email can hand an attacker code execution on your mail server, with no credentials required, is not a drill.

If you have managed IT services handling your patching, ask for confirmation that the September updates are deployed and accounted for. This is a month where it matters more than usual.