Executive Summary
CISA has added CVE-2026-81963, a Windows Update Stack link following vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog on September 8, 2026, confirming the flaw is being actively exploited in the wild. The bug allows an already-authenticated local attacker to escalate privileges up to SYSTEM, and it was one of four vulnerabilities CISA added to the catalog the same day, alongside the Adobe Commerce/Magento "StyleSmuggler" zero-day (CVE-2026-75650), a Windows heap-based buffer overflow (CVE-2026-85880), and an N-able N-central static code injection bug (CVE-2026-86218).
CVSS Score: 7.8 (High)
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-81963 |
| CVSS Score | 7.8 (High) |
| Type | Improper Link Resolution Before File Access ("link following") / Improper Access Control |
| Component | Windows Update Stack |
| Attack Vector | Local |
| Privileges Required | Low (authenticated local user) |
| User Interaction | None |
| CWE | CWE-1336 |
| Added to CISA KEV | September 8, 2026 |
| Federal Remediation Due | September 22, 2026 |
How It Works
The flaw lives in the Windows Update Stack and stems from improper link resolution before file access — a classic "link following" weakness in which the operating system follows a symbolic link, junction, or similar filesystem reference to a location the calling process did not intend to access. An attacker who already has low-privileged local access can plant such a link so that a Windows Update Stack operation running with elevated privileges is redirected to act on an attacker-controlled file or path, ultimately allowing the attacker to elevate privileges locally, up to SYSTEM.
Because the vector is local rather than network-facing, this is not a remote-exploitation bug — it requires an attacker to already have a foothold (a low-privileged session, a phished user account, or a webshell) on the target machine. In that scenario, it becomes a straightforward path from limited access to full administrative control, which is precisely the kind of bug ransomware affiliates and post-exploitation toolkits look for once initial access is achieved.
Affected Software
| Product | Affected Versions |
|---|---|
| Windows 11 | 23H2, 24H2, 25H2, 26H1 |
| Windows Server 2025 | Including Server Core installations |
Microsoft addressed the vulnerability as part of its September 2026 Patch Tuesday release. Fixed builds are available for each affected version (for example, build 10.0.22631.7582 for Windows 11 23H2), with corresponding patched builds for the other listed products.
Remediation
- Apply the September 2026 cumulative update for your Windows 11 or Windows Server 2025 build immediately via Windows Update or WSUS/Intune/SCCM.
- Prioritize systems where local access is more likely to be abused — shared workstations, jump boxes, terminal servers, and any host already flagged for suspicious low-privilege activity.
- Follow CISA's BOD 26-04 guidance for prioritizing this update based on risk, and complete the required forensic triage steps for any host suspected of prior compromise before considering it remediated.
- Federal civilian agencies must remediate by September 22, 2026 per the KEV catalog entry; all organizations should treat that date as a reasonable internal deadline regardless of sector.
Why This Matters
Link-following privilege escalation bugs rarely make headlines the way pre-auth RCEs do, but they are a staple of real-world intrusions: an attacker who lands limited access through phishing, a stolen credential, or an unrelated web-facing vulnerability needs exactly this kind of bug to go from "a foothold" to "domain admin." CISA's KEV listing confirms this one is not theoretical — it is already being used in active attacks, which means every unpatched Windows 11 or Windows Server 2025 host should be treated as a viable privilege-escalation target the moment an attacker gets a single low-privileged session on it.