Intel

CVE-2026-81963

Windows Update Stack Elevation of Privilege Vulnerability

criticalKEV: actively exploitedPoCEPSS 0.6%

Description

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

Source: BSI_CSAFBSIMSRCCVELISTV5NVDCVEORGCISA_KEV

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2026-81963 carries a CVSS 7.8 score with the vector AV:L/AC:L/PR:L/UI:N — meaning any authenticated local user, with no special configuration and no user interaction required, can escalate to SYSTEM. For NIS2-scoped and KRITIS organisations this is a high-priority patch because attackers who have already gained an initial foothold via phishing or credential theft can use this vulnerability as a reliable, low-complexity second step to achieve full system compromise. Although CISA has not flagged known ransomware campaign use at this time, LPE vulnerabilities in core OS components like the Windows Update Stack are a staple of multi-stage attack chains. Organisations with large numbers of unmanaged endpoints, weak least-privilege enforcement, or slow patch cycles should treat this as a critical-priority remediation item.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch: Microsoft has released a fix for CVE-2026-81963 in the Windows Update Stack — look up the exact KB number and affected Windows versions in the current Microsoft Security Update Guide and deploy immediately via WSUS/SCCM/Intune.
  • Prioritise patching for highest-risk assets first: domain controllers, jump servers, Privileged Access Workstations (PAWs), and internet-facing systems, where local privilege escalation has the greatest blast radius.
  • Enforce least-privilege on all endpoints: confirm that standard users do not hold local administrator rights. Temporarily disable unused local accounts to reduce the attacker's available foothold options.
  • Enable enhanced monitoring on Windows Update Stack processes (wuauclt.exe, TiWorker.exe, svchost.exe -k netsvcs) — alert on unexpected child processes spawned with elevated integrity levels.
  • Raise SOC alert thresholds for privilege-escalation events and activate escalation paths for any related detections until the patch is fully deployed across the estate.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Move unpatched systems into isolated VLANs and restrict lateral-movement paths — block SMB (port 445) and RPC (port 135) between segments where not operationally required.
  • Endpoint hardening: Enable Windows Defender Credential Guard and Windows Defender Application Control (WDAC). Activate Attack Surface Reduction (ASR) rules to limit the attacker's post-escalation options.
  • IAM / least-privilege: Secure local administrator accounts with Microsoft LAPS. Ensure service accounts have no interactive logon rights and are not members of local administrator groups.
  • Symlink/junction restriction: Via GPO, restrict symbolic link creation to administrators only: Local Policies > User Rights Assignment > Create symbolic links — remove this right from all non-admin accounts.
  • IPS/EDR policy: Configure EDR policies to detect link-following patterns — specifically, junction or symlink creation inside %SystemRoot%\System32 or %ProgramFiles% by Medium-integrity processes. Flag and alert immediately.
  • Audit logging: Enable Object Access auditing (Audit Object Access) via GPO and forward symlink-creation and file-access events to your SIEM for correlation.

Runbook · Step 3

Detection rules

  • Sysmon EID 11 / EID 1: Detect creation of symbolic links or junctions by Medium-integrity processes in protected directories. Sigma shape: EventID: 11 | TargetFilename|contains: '\Windows\' | IntegrityLevel: Medium
  • Windows Event ID 4688: Alert on wuauclt.exe or TiWorker.exe spawned with unexpected command-line arguments or unusual parent processes (e.g. cmd.exe, powershell.exe). KQL: SecurityEvent | where EventID == 4688 and NewProcessName has "wuauclt" and ParentProcessName has_any ("cmd.exe","powershell.exe")
  • Windows Event IDs 4672 / 4673: Alert on sensitive privilege assignment (SeDebugPrivilege, SeTakeOwnershipPrivilege) to accounts that do not normally hold those rights, especially when correlated with Update Stack process activity in the same session.
  • EDR process-ancestry chain: Alert when a Medium-integrity process spawns a child process at High or System integrity that is not initiated by a Microsoft-signed installer — this is a strong indicator of successful LPE exploitation.
  • Object Access auditing: Enable write-access auditing on %SystemRoot%\System32\Tasks and %SystemRoot%\Temp; alert on write events by any account other than SYSTEM or TrustedInstaller.

Metrics

Severity
critical
Priority score
197.91
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
7.8
Source: nvd-v3
CVSS v3
7.8
CVSS v4
—
EPSS percentile
48.2 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
EPSS score
0.6 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-09-08 07:00 UTC
CWE
CWE-59, CWE-284

Weakness classes (CWE)

  • CWE-59Base

    Improper Link Resolution Before File Access ('Link Following')

    The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

    cwe.mitre.org →

  • CWE-284Pillar

    Improper Access Control

    The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-09-09 05:18 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-81963","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technica… → {"id":"CVE-2026-81963","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technica…
  2. Initial Analysis2026-09-08 19:28 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.26100.33438 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.22631.7582 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.22631.7582 *cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.26100.9445 *cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26100.9445 *cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.26200.9445 *cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26200.9445 *cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.28000.2954 *cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.28000.2954
    • Reference Type: Microsoft Corporation: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963 Types: Patch, Vendor Advisory
    • Reference Type: CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963 Types: US Government Resource
  3. CVE Modified2026-09-08 19:19 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • Reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963
    • SSVC: {"id":"CVE-2026-81963","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI… → {"id":"CVE-2026-81963","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technica…
  4. CVE CISA KEV Update2026-09-08 19:00 UTC· 9119a7d8-5eab-497f-8521-727c672e3725
    • Date Added: 2026-09-08
    • Due Date: 2026-09-08
    • Required Action: 2026-09-08
    • Vulnerability Name: 2026-09-08
  5. New CVE Received2026-09-08 18:21 UTC· secure@microsoft.com
    • Description: Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
    • CVSS V3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    • CWE: CWE-59
    • CWE: CWE-284

Affected operating systems

  • windows

    microsoft / windows_11_23h2

  • windows

    microsoft / windows_11_24h2

  • windows

    microsoft / windows_11_25h2

  • windows

    microsoft / windows_11_26h1

  • windows

    microsoft / windows_server_2025

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked advisories

IDCVE-2026-81963