{"id":"CVE-2026-81963","kind":"vulnerability","aliases":["CVE-2026-81963"],"related":[],"title":"Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker…","description":"Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Link-following flaw (CWE-59) in the Windows Update Stack lets a local low-privileged user escalate to SYSTEM. Microsoft confirms exploitation in the wild. It affects Windows 11 23H2, 24H2, 25H2 and 26H1 and Windows Server 2025. It was fixed in the September 2026 cumulative updates.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2026-09-08T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7582"],"affected":">= 10.0.22631.0, < 10.0.22631.7582","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9445"],"affected":">= 10.0.26100.0, < 10.0.26100.9445","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9445"],"affected":">= 10.0.26200.0, < 10.0.26200.9445","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.2954"],"affected":">= 10.0.28000.0, < 10.0.28000.2954","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33438"],"affected":">= 10.0.26100.0, < 10.0.26100.33438","ecosystem":"vendor"},{"name":"microsoft windows 11 23h2","fixed":["10.0.22631.7582"],"affected":"< 10.0.22631.7582","ecosystem":"vendor"},{"name":"microsoft windows 11 24h2","fixed":["10.0.26100.9445"],"affected":"< 10.0.26100.9445","ecosystem":"vendor"},{"name":"microsoft windows 11 25h2","fixed":["10.0.26200.9445"],"affected":"< 10.0.26200.9445","ecosystem":"vendor"},{"name":"microsoft windows 11 26h1","fixed":["10.0.28000.2954"],"affected":"< 10.0.28000.2954","ecosystem":"vendor"},{"name":"microsoft windows server 2025","fixed":["10.0.26100.33438"],"affected":"< 10.0.26100.33438","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","privilege-escalation","self-hosted","windows","windows-11","windows-server-2025"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"Run winver or [System.Environment]::OSVersion in PowerShell and compare the build with the fixed builds: 23H2 below 10.0.22631.7582, 24H2 below 10.0.26100.9445, 25H2 below 10.0.26200.9445, 26H1 below 10.0.28000.2954. Or check with Get-HotFix for the September 2026 KB (KB5122880 for 23H2, KB5124008 for 24H2 and 25H2, KB5124012 for 26H1, KB5122871 for Server 2025).","fix":"Install the September 2026 (or later) cumulative update: Win11 23H2 10.0.22631.7582 (KB5122880), 24H2 10.0.26100.9445 and 25H2 10.0.26200.9445 (KB5124008), 26H1 10.0.28000.2954 (KB5124012), Server 2025 (KB5122871). No workaround is documented. After patching, follow CISA's forensic triage guidance, because exploitation was seen before the patch.","status":"open","published_at":"2026-09-08T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:38+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T20:31:38Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft update for CVE-2026-81963 per vendor instructions; the sources do not name the patched build. Follow CISA BOD 26-04 guidance and forensic triage steps referenced in the KEV entry.","summary":"A link following flaw in the Windows Update stack lets a local user with limited access escalate privileges to SYSTEM. An attacker who already has a foothold on the machine gets full control of it.","category":"infrastructure","who_cares":["windows","self-hosted"],"confidence":0.6,"analyst_note":"Find the Microsoft advisory for CVE-2026-81963 for affected builds, patched KB numbers, and a detection method; the KEV entry links to the CISA catalog only.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"severity_if_unknown":"high"},"cost_usd":0.000371,"input_tokens":2184,"output_tokens":306,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-81963 for affected builds, patched KB numbers, and a detection method; the KEV entry links to the CISA catalog only.","search":"'-04':162C,188C,219C '-11':70B '-2026':18A,21A '-59':80B '-81963':19A,22A '11':26A,29A,32A,35A,42A,46A,50A,54A,105B '2025':39A,59A,74B,114B '2026':121B '23h2':27A,43A,106B '24h2':30A,47A,107B '25h2':33A,51A,108B '26':161C,187C,218C '26h1':36A,55A,110B 'access':6A 'accord':151C 'action':147C 'adher':215C 'affect':103B 'allow':13A,134C 'appli':148C 'applic':185C 'asset':209C 'attack':16A,137C 'author':15A 'base':166C 'bod':160C,186C,217C 'cisa':145C,158C,175C 'cloud':191C 'complianc':156C 'confirm':97B 'contain':128C 'cumul':122B 'cve':17A,20A 'cwe':79B 'discontinu':194C 'ensur':155C,214C 'escal':64B,93B,139C 'evalu':207C 'exploit':60B,98B 'exposur':212C 'file':5A 'fix':117B 'flaw':78B 'follow':8A,77B,131C,184C 'forens':177C 'guidanc':173C,189C 'guidelin':221C 'host':67B 'improp':1A 'infrastructur':61B 'instruct':154C 'internet':211C 'let':86B 'link':2A,7A,76B,130C 'link-follow':75B 'local':88B,136C,141C 'low':90B 'low-privileg':89B 'microsoft':23A,40A,44A,48A,52A,56A,96B,124C 'mitig':149C,200C 'note':172C,183C 'patch':220C 'priorit':163C 'privileg':63B,91B,140C 'privilege-escal':62B 'product':198C 'requir':146C,179C 'resolut':3A 'respons':205C 'risk':168C 'secur':164C 'see':169C,180C 'self':66B 'self-host':65B 'septemb':120B 'server':38A,58A,73B,113B 'servic':192C 'stack':12A,85B,127C 'stakehold':203C 'system':95B,144C 'triag':178C 'unavail':202C 'updat':11A,84B,123B,126C,165C 'url':170C,181C 'use':195C 'user':92B 'vendor':153C 'vulner':132C 'wild':101B 'window':10A,68B,69B,72B,83B,104B,112B,125C 'windows':24A,25A,28A,31A,34A,37A,41A,45A,49A,53A,57A 'windows-serv':71B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-08T00:00:00+00:00","kev":{"dateAdded":"2026-09-08","dueDate":"2026-09-22","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-81963","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81963","severity":null,"published_at":"2026-09-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-81963:124","url":null,"severity":null,"published_at":"2026-10-23T21:39:23+00:00","modified_at":"2026-10-23T21:39:23+00:00","first_seen_at":"2026-10-23T21:39:23+00:00","fetched_at":"2026-10-23T21:39:23+00:00","note":"Read MSRC advisory (released Sep 8 2026, updated Oct 7; Exploitation Detected, not publicly disclosed) and CVE record for build ranges; KBs from Rapid7 (secondary, not MSRC). No public PoC found; X/social not searched. Server 2025 build in CVE record is 10.0.26100.33438 and looks odd; verify against MSRC table."},{"source":"nvd","external_id":"CVE-2026-81963","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81963","severity":null,"published_at":"2026-09-08T18:21:00+00:00","modified_at":"2026-09-09T05:18:17+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1174,"url":"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-81963","title":"MSRC: Windows Update Stack Elevation of Privilege Vulnerability (CVE-2026-81963)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1175,"url":"https://www.cve.org/CVERecord?id=CVE-2026-81963","title":"CVE Record CVE-2026-81963 (affected build ranges)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1176,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-81963/","title":"Rapid7 DB: CVE-2026-81963 (KB list)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1177,"url":"https://cert.gov.vu/images/publications/2026/Advisory_274.pdf","title":"CERT Vanuatu Advisory 274","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}