CVE-2026-81963

What it is

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

At a glance

Exploitability

Can be exploited locally on the machine with a low-privilege account. High risk of data exposure, data tampering, service disruption.

In the wild

CISA lists this as exploited in real attacks. Treat as urgent.

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-08-27 20:58 UTC ReservedThe CVE id was reserved by its CNA
2. 2026-09-08 Exploited in the wildAdded to CISA's Known Exploited Vulnerabilities list
3. 2026-09-08 18:21 UTC PublishedDisclosed publicly on CVE.org and NVD
4. 2026-09-09 05:18 UTC Last updatedMost recent change to the record
5. 2026-09-22 Remediation deadlineCISA's due date for federal agencies to fix it

Details

Published

2026-09-08 18:21 UTC

Last modified

2026-09-09 05:18 UTC

Added to CISA KEV

2026-09-08

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-59

Record status

Analyzed

Affected

• Microsoft Windows 11 23h2 < 10.0.22631.7582
• Microsoft Windows 11 24h2 < 10.0.26100.9445
• Microsoft Windows 11 25h2 < 10.0.26200.9445
• Microsoft Windows 11 26h1 < 10.0.28000.2954
• Microsoft Windows Server 2025 < 10.0.26100.33438

Attack profile CVSS 3.1 · 7.8

Attack vector

Local

Complexity

Low

Privileges needed

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High