Our automated tracking framework flagged that CISA added CVE-2026-85880 (Microsoft Windows) to the Known Exploited Vulnerabilities (KEV) catalog on September 10, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-85880 by September 22, 2026 — a 14-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-85880 |
| Vendor / product | Microsoft Windows |
| Vulnerability | Microsoft Windows Heap-Based Buffer Overflow Vulnerability |
| CVSS base score | 7.8 |
| Added to KEV | September 8, 2026 |
| Days public before listing (NVD → KEV lag) | 0 |
| Federal patch deadline | September 22, 2026 |
| Known ransomware use | No |
How This Compares to Microsoft’s Track Record
This one was listed on or before its public disclosure (a lag of 0 days) — a zero-day exploited at or before the vulnerability was even published. Microsoft currently ranks #18 on our KEV Lag leaderboard.
| Microsoft in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 388 |
| Median lag (public → KEV listing) | 546 days |
| 0-day rate (exploited at or before disclosure) | 23% |
| Entries tied to known ransomware campaigns | 104 |
For perspective, the median across all 1703 tracked KEV entries is 260 days — Microsoft’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Microsoft KEV Additions
The most recent Microsoft vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-81963 | Windows | September 8, 2026 | 0 | No |
| CVE-2019-1068 | SQL Server | August 26, 2026 | 2599 | No |
| CVE-2026-33824 | Internet Key Exchange (IKE) Service Extensions | August 18, 2026 | 126 | No |
| CVE-2026-55040 | SharePoint | August 18, 2026 | 35 | No |
| CVE-2026-68820 | Windows Ancillary Function Driver for WinSock | August 11, 2026 | 0 | No |
Defense guide: How to Detect Zero-day Vulnerability: Attack Chain & Defense — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has added CVE-2026-85880, a Microsoft Windows heap-based buffer overflow vulnerability (CVSS 7.8), to its Known Exploited Vulnerabilities (KEV) catalog with a federal patch deadline of September 22, 2026. Patch Microsoft Windows systems before this date. The vulnerability was added to the KEV catalog on the same day it was made public, indicating active exploitation at the time of disclosure. This means there’s a narrow window for defenders to apply the patch before attackers leverage the vulnerability in broader campaigns.
For systems that cannot be patched by the September 22 deadline, restrict network access. Implement strict network segmentation to isolate vulnerable Microsoft Windows systems, and enhance monitoring for unusual activity. Enforcing the principle of least privilege and deploying endpoint detection and response (EDR) solutions can provide temporary layers of defense until the patch is applied. There’s no known ransomware use for CVE-2026-85880.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- Microsoft’s CVE-2026-68820 Was Exploited in 0 Days — Well Under Its 567-Day Median (August 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
