CISA added CVE-2026-81963 to the Known Exploited Vulnerabilities catalog on 2026-09-08, confirming active exploitation of a link following flaw in the Windows Update Stack that lets a local attacker elevate privileges.
What Is It
CVE-2026-81963 is an improper link resolution before file access ("link following") vulnerability in the Windows Update Stack. Per Microsoft's description, it allows an authorized attacker to elevate privileges locally. CISA's KEV entry mirrors that vendor wording; neither source specifies the privilege level reached, so treat claims of a direct path to SYSTEM as unconfirmed pending further vendor or researcher detail.
The flaw is tracked under CWE-59 (link following) and CWE-284 (improper access control). Microsoft assigned a CVSS 3.1 base score of 7.8 (HIGH), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, local attack vector, low complexity, low privileges required, no user interaction, with high confidentiality, integrity, and availability impact.
Why It Matters
CISA's SSVC assessment marks exploitation as active, technical impact as total, and automatable as no. The KEV listing confirms real-world exploitation rather than theoretical risk. Known ransomware campaign use is listed as Unknown.
Because the attacker already needs local access with low privileges, this is a post-compromise escalation primitive: it converts a foothold on a standard user account into significantly greater control, with CISA rating the technical impact as total. That it lives in the Update Stack, a component present and privileged on every affected build, means there is no optional feature to disable.
What's Vulnerable
Affected products and fixed build thresholds:
- Windows 11 23H2 (x64, ARM64), before 10.0.22631.7582
- Windows 11 24H2 (x64, ARM64), before 10.0.26100.9445
- Windows 11 25H2 (x64, ARM64), before 10.0.26200.9445
- Windows 11 26H1 (x64, ARM64), before 10.0.28000.2954
- Windows Server 2025 and Server 2025 (Server Core) (x64), before 10.0.26100.33438
One caveat on that list: Windows 11 24H2 and Windows Server 2025 are built from the same 10.0.26100 servicing branch and take the same cumulative updates, so a single 26100 revision should gate both. The two thresholds above do not reconcile, which means at least one of the published revision numbers is unreliable. Rather than patching to whichever number is lower, check the actual build revision of each 26100 host against the current MSRC entry and the installed cumulative update KB before declaring it remediated.
Patch Status
Microsoft published its advisory on 2026-09-08. CISA's required action: apply mitigations per vendor instructions in compliance with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure and adhere to BOD 26-04 patching guidelines.
Due date: 2026-09-22. Forensic triage is flagged as not required for this entry.