CISA Adds Windows ALPC Heap Overflow (CVE-2026-85880) to KEV Catalog Amid Active Exploitation

CISA has added CVE-2026-85880 to its Known Exploited Vulnerabilities (KEV) catalog. According to Microsoft's advisory, the flaw is a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) component that allows a local attacker to elevate privileges. No CVSS score has been published at this time, and details on the exploitation vector, threat actor attribution, or ransomware association remain unconfirmed — CISA's ransomware-use field for this entry is listed as "Unknown."

Why It Matters

ALPC is a core Windows inter-process communication mechanism used extensively by system services, making privilege-escalation bugs in this component historically attractive for local privilege escalation (LPE) chains. A KEV listing confirms active exploitation is occurring in the wild, though CISA's inclusion criteria do not require disclosure of scale or targeting. Because this is an LPE flaw rather than a remote code execution vector, it is most dangerous when paired with an initial-access vector (phishing, a separate remote exploit, or existing foothold) — attackers use bugs like this to escalate from a standard user context to SYSTEM once they're already on a box. Any organization running affected Windows systems should treat this as a priority patching item, particularly for endpoints and servers exposed to less-trusted users or processes.

What Defenders Should Watch For

• Prioritize patching per Microsoft's guidance as soon as an update is available; if unpatched, monitor advisories for interim mitigations.
• Hunt for anomalous process behavior consistent with local privilege escalation: unexpected child processes spawned by low-privilege accounts that suddenly gain SYSTEM-level tokens, unusual ALPC port creation/connection activity, or crash/exception events tied to lsass.exe, csrss.exe, or other RPC/ALPC-dependent processes.
• Review EDR telemetry for token manipulation events (e.g., token duplication/impersonation) immediately following process crashes or unusual memory allocation patterns in system processes.
• Since KEV entries indicate confirmed in-the-wild use, treat any unexplained SYSTEM-level activity originating from standard user sessions as high priority for investigation, especially on internet-facing or multi-user Windows hosts.
• CISA KEV inclusion typically triggers mandated remediation timelines for U.S. federal agencies under BOD 22-01 — organizations tracking that directive should confirm applicability and deadlines.

This is developing intel based on a same-day KEV addition; technical details on the exploitation method and affected Windows versions are still emerging. For authoritative and updated guidance, consult Microsoft's advisory directly at msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-85880.