Rewterz

BlackMoon Banking Trojan aka KrBanker – Active IOCs

September 7, 2026
Rewterz

GitLab Fixes Critical RCE and Credential Theft Flaws

September 11, 2026

Multiple Microsoft Windows Products Vulnerabilities Exploit in the Wild

Severity

High

Analysis Summary

CVE-2026-85880 CVSS:7.8

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

CVE-2026-81963 CVSS:7.8

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

Impact

  • Privilege Escalation

Indicators of Compromise

CVE

  • CVE-2026-85880

  • CVE-2026-81963

Affected Vendors

  • Microsoft

Affected Products

  • Microsoft Windows 10 Version 1607 for 32-bit Systems
  • Microsoft Windows 10 Version 1607 for x64-based Systems
  • Microsoft Windows 10 Version 1809 for 32-bit Systems
  • Microsoft Windows 10 Version 1809 for x64-based Systems
  • Microsoft Windows Server 2012 R2
  • Microsoft Windows Server 2019 (Server Core installation)
  • Microsoft Windows Server 2022 (Server Core installation)
  • Microsoft Windows Server 2012 (Server Core installation)
  • Microsoft Windows Server 2012 R2 (Server Core installation)
  • Microsoft Windows Server 2016 (Server Core installation)
  • Microsoft Windows 10 Version 22H2 for x64-based Systems
  • Microsoft Windows 10 Version 21H2 for x64-based Systems
  • Microsoft Windows 10 Version 22H2 for 32-bit Systems
  • Microsoft Windows 10 Version 22H2 for ARM64-based Systems
  • Microsoft Windows 10 Version 21H2 for ARM64-based Systems
  • Microsoft Windows 10 Version 21H2 for 32-bit Systems

Remediation

Use Microsoft Automatic Update to apply the appropriate patch for your system, or the Microsoft Security Update Guide to search for available patches.

CVE-2026-85880

CVE-2026-81963

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.