Microsoft reports active exploitation of the CVE-2026-81963 vulnerability in the Windows Update Stack component. The vulnerability allows a local authenticated attacker to achieve privilege escalation through improper handling of symbolic links (link following). CISA has added CVE-2026-81963 to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 22, 2026 — less than a week remains until this date. All organizations using Windows should prioritize installing the corresponding security update.
Technical details of the vulnerability
According to the Microsoft advisory, the root cause is a class of vulnerabilities called improper link resolution before file access, also known as “link following” (CWE-59). The crux of the issue: when working with files, the Windows Update Stack component does not properly verify whether a path points to a symbolic link (symlink) or junction created by an attacker. This makes it possible to substitute the target file or directory that the privileged update process accesses.
Key characteristics of the attack vector:
- Local access — the attacker must be able to execute code on the target system
- Authentication — an account is required, even if it has limited privileges
- Privilege escalation — exploitation results in obtaining privileges higher than the attacker’s original rights
Windows Update Stack runs with SYSTEM privileges — one of the most privileged contexts in Windows. Link following–type vulnerabilities in such components typically allow an attacker to force a privileged process to write data to an arbitrary location or overwrite critical system files, leading to full system compromise.
Microsoft notes that the vulnerability was not publicly disclosed before the patch was released; however, exploitation has already been observed in current software versions. The CVSS score and a list of specific affected Windows versions are not provided in the published advisory.
Exploitation status
According to Microsoft, exploitation of CVE-2026-81963 has been confirmed: the vulnerability status is “Exploited: Yes,” and for current software versions the advisory states “Exploitation Detected.” The vulnerability was added to the CISA KEV catalog on September 8, 2026, which confirms that the threat is assessed as real and active.
There is currently no information on which specific groups or campaigns are using this vulnerability. Indicators of compromise (IOCs) have also not been published. Nevertheless, the very fact of its inclusion in CISA KEV means that the agency has sufficient evidence of exploitation in real-world attacks.
Impact assessment
Windows Update Stack is a critical system component present in all supported versions of Windows. Privilege escalation vulnerabilities in this component are particularly dangerous for several reasons:
- The update service runs with maximum privileges and has access to protected areas of the file system
- The component is active on every Windows system, which provides a broad attack surface
- Privilege escalation is often used as an intermediate step in an attack chain — after initial access and before persistence or lateral movement
We have already covered CVE-2026-81963 in our September Patch Tuesday overview, where this vulnerability was part of a record set of roughly 970 fixes. Another actively exploited privilege escalation vulnerability in Windows from the same update cycle — CVE-2026-85880 in Windows ALPC — also requires prompt attention.
Recommendations
- Install the security updates from Microsoft’s September release. The CISA KEV deadline of September 22, 2026 applies to all U.S. federal agencies but is a reasonable benchmark for any organization
- Verify update status on servers and workstations: systems with delayed updates are the most vulnerable
- Restrict local access: since exploitation requires authenticated local access, minimizing the number of users with interactive logon to critical servers reduces risk
- Monitor the creation of symbolic links in directories related to Windows Update (for example,
%SystemRoot%\SoftwareDistribution) — abnormal activity may indicate an attempted exploit - The full list of affected versions and patches is available in the Microsoft advisory and on the NVD page
CVE-2026-81963 is a confirmed exploited vulnerability with a strict remediation deadline just a few days away. The priority is the immediate installation of Microsoft’s September security updates on all Windows systems, starting with servers and workstations that support multiple users.
