CVE-2026-81963

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-81963 7.8

Microsoft · Windows · Added 2026-09-08 · Published 2026-09-08

3-Day Required KEV Active Exploitation

Details

VulnerabilityMicrosoft Windows Link Following Vulnerability

VendorMicrosoft

ProductWindows

Date added2026-09-08

Due date2026-09-22

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-284 CWE-59

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.

NVD: Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-09-08 19:41 UTC

Searches4

Component defaultyes

Sources https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963
https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880
https://www.rapid7.com/db/vulnerabilities/cve-2026-81963/
https://cybersecuritynews.com/microsoft-patch-tuesday-update-september-2026/
https://www.action1.com/vulnerabilities/cve-2026-81963/

QC notes

warn component_extraction: Component 'Windows Update Stack — symlink/junction resolution during update file operations allows local attacker-controlled paths to overwrite privileged system files' matches or contains product name 'Windows' — no specific component identified

Hunting hypothesis agent

Look for NTFS junction creation in C:\Windows\SoftwareDistribution\Download pointing to System32, then out-of-path writes by TiWorker.exe -- Sysmon EID 11 in SoftwareDistribution reveals the junction-based privilege escalation.

Research details

ComponentWindows Update Stack — symlink/junction resolution during update file operations allows local attacker-controlled paths to overwrite privileged system files

PreconditionsThe attacker must have local low-privileged user access (no elevated privileges required) on the target system. The target must run a vulnerable version of Windows 11 (23H2, 24H2, 25H2, 26H1) or Windows Server 2025. The Windows Update Stack service must be running and processing update operations — the attacker creates a symlink or NTFS junction pointing to a privileged system directory, then triggers or waits for the Update Stack to resolve the link, causing a file operation to follow the attacker-controlled path. No network access or user interaction is required; exploitation is entirely local. agent

Public PoCno

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963

Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.0–8.9). This is the first Windows Update Stack EoP vulnerability exploited in the wild as a zero-day since Microsoft began tracking them in 2022; seven Update Stack EoPs have been patched previously but none were actively exploited. Exploitation requires local access only (AV:L) with low complexity and no privileges, and grants SYSTEM-level impact. No public PoC is available as of September 8, 2026.

SummaryCVE-2026-81963 is a high-severity (CVSS 7.8) elevation of privilege vulnerability in the Windows Update Stack affecting Windows 11 23H2, 24H2, 25H2, 26H1, and Windows Server 2025. The flaw is a link following (CWE-59) issue where the Update Stack improperly resolves symbolic links or NTFS junctions before file access, allowing a local low-privileged attacker to redirect file operations to arbitrary privileged locations and escalate to SYSTEM. This is the first Windows Update Stack EoP to be exploited in the wild as a zero-day; seven prior Update Stack EoPs have been patched since 2022 but none were actively exploited. Microsoft released a fix in the September 2026 Patch Tuesday update.

Tia coverage

First reported2026-06-10

First exploit report2026-09-08

Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-2026-0908-cisa-adds-4-known-exploited-vulnerabilities-to-ca microsoft-s-september-2026-patch-tuesday-fixes-two-zero-day-flaw

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.