Live › vulnerability › CVE-2026-81963
Go to dashboardLink-following flaw (CWE-59) in the Windows Update Stack lets a local low-privileged user escalate to SYSTEM. Microsoft confirms exploitation in the wild. It affects Windows 11 23H2, 24H2, 25H2 and 26H1 and Windows Server 2025. It was fixed in the September 2026 cumulative updates.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft Windows | vendor | – | – |
| Windows 11 23H2 | vendor | >= 10.0.22631.0, < 10.0.22631.7582 | 10.0.22631.7582 |
| Windows 11 24H2 | vendor | >= 10.0.26100.0, < 10.0.26100.9445 | 10.0.26100.9445 |
| Windows 11 25H2 | vendor | >= 10.0.26200.0, < 10.0.26200.9445 |
| 10.0.26200.9445 |
| Windows 11 26H1 | vendor | >= 10.0.28000.0, < 10.0.28000.2954 | 10.0.28000.2954 |
| Windows Server 2025 | vendor | >= 10.0.26100.0, < 10.0.26100.33438 | 10.0.26100.33438 |
| microsoft windows 11 23h2 | vendor | < 10.0.22631.7582 | 10.0.22631.7582 |
| microsoft windows 11 24h2 | vendor | < 10.0.26100.9445 | 10.0.26100.9445 |
| microsoft windows 11 25h2 | vendor | < 10.0.26200.9445 | 10.0.26200.9445 |
| microsoft windows 11 26h1 | vendor | < 10.0.28000.2954 | 10.0.28000.2954 |
| microsoft windows server 2025 | vendor | < 10.0.26100.33438 | 10.0.26100.33438 |
10.0.22631.7582, 24H2 below 10.0.26100.9445, 25H2 below 10.0.26200.9445, 26H1 below 10.0.28000.295410.0.22631.7582 (KB5122880), 24H2 10.0.26100.9445 and 25H2 10.0.26200.9445 (KB5124008), 26H1 10.0.28000.2954 (KB5124012), Server 2025 (KB5122871)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2026-81963")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.