Listen to this Post
CVE-2026-81963 is a Windows Update Stack vulnerability.
It is classified as improper link resolution before file access.
The common weakness is CWE-59 link following.
Microsoft also maps it to CWE-284 improper access control.
The flaw allows an authorized attacker to elevate privileges locally.
The attacker must already have some access to the target Windows system.
The Windows Update Stack runs with elevated privileges.
It handles files, paths, and update-related resources.
Link following occurs when a program follows a symbolic link or junction.
If resolution is improper, the program may access an unintended file.
An attacker can create a link that points to a privileged location.
When the Update Stack processes the link, it may follow it.
The privileged process may then read, write, or execute as a higher integrity level.
This can break the security boundary between user and system.
The result is local privilege escalation.
The vulnerability affects Windows 11 23H2, 24H2, 25H2, and 26H1.
It also affects Windows Server 2025 and Server Core installation.
The fixed builds are listed by Microsoft.
Windows 11 23H2 is fixed at 10.0.22631.7582.
Windows 11 24H2 is fixed at 10.0.26100.9445.
Windows 11 25H2 is fixed at 10.0.26200.9445.
Windows 11 26H1 is fixed at 10.0.28000.2954.
Windows Server 2025 is fixed at 10.0.26100.33438.
NVD published the CVE on September 08, 2026.
NVD last modified it on September 09, 2026.
Microsoft is the source and vendor.
CISA added it to the Known Exploited Vulnerabilities Catalog.
CISA added it on September 08, 2026.
CISA due date is September 22, 2026.
Required action is to apply mitigations per vendor instructions.
This CVE is a real link-following privilege escalation example.
DailyCVE Form:
Platform: Windows Update Stack
Version: Multiple Windows versions
Vulnerability: Link Following
Severity: Not Specified
date: September 08, 2026
Prediction: September 22, 2026
What Undercode Say:
Analytics
Check Windows version and build from Bash/WSL powershell.exe -NoProfile -Command "Get-ComputerInfo | Select-Object OsName,OsVersion,OsBuildNumber" Compare affected build thresholds for b in 22631.7582 26100.9445 26200.9445 28000.2954 26100.33438; do echo "$b"; done Check Windows Update service powershell.exe -NoProfile -Command "Get-Service wuauserv | Select-Object Status,Name,DisplayName" List installed hotfixes wmic qfe list brief /format:list Educational link-following lab only mklink /D C:\Temp\cve_2026_81963_link C:\Temp\cve_2026_81963_target PowerShell educational symlink test New-Item -ItemType SymbolicLink -Path "C:\Temp\cve_2026_81963_link" -Target "C:\Temp\cve_2026_81963_target" Remove educational lab link Remove-Item "C:\Temp\cve_2026_81963_link" -Force
Exploit: (Educational Purposes!)
1. Attacker obtains low-privileged local access. 2. Attacker creates a symbolic link or junction in a Windows Update Stack path. 3. The link points to a privileged file or directory. 4. Windows Update Stack resolves the link improperly. 5. The privileged update process follows the attacker-controlled link. 6. The process accesses the linked target with elevated rights. 7. This can lead to local privilege escalation. 8. Update to fixed builds to remove the vulnerable link-following behavior.
Protection: from this CVE
Apply Microsoft updates. Upgrade to fixed builds. Follow CISA KEV due date. Restrict symlink creation. Use least privilege. Monitor Update Stack activity.
Impact:
Local privilege escalation. Authorized attacker gains elevated privileges. Known exploited vulnerability. Affects Windows 11 and Windows Server 2025. CISA required action by September 22, 2026.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
