CVE-2026-81963

What is the Windows Update Stack?

The Windows Update stack is the set of services and components that download, verify, and install operating-system and component updates on essentially every Windows machine. Because it must write to protected locations and run with high privilege, it is an attractive place to look for privilege-escalation bugs: an attacker who already has a low-privileged foothold uses a flaw here to climb to SYSTEM, the highest local privilege, and from there disable defenses or move laterally.

Overview

CVE-2026-81963 is a link-following vulnerability (CWE-59) in the Windows Update stack, rated CVSS 7.8. A locally authenticated, low-privileged attacker can elevate to SYSTEM without any user interaction. Microsoft confirmed exploitation in the wild at the September 2026 Patch Tuesday, and CISA added the CVE to KEV the same day. It was one of only two zero-days in a record-sized Patch Tuesday.

Affected Versions

Apply the September 2026 cumulative update for your specific Windows or Windows Server version and edition. Consult the MSRC entry for the exact KB numbers per build.

Technical Details

A link-following (CWE-59) flaw arises when a privileged process follows a symbolic link, junction, or hard link that a lower-privileged user controls, and performs a file operation on the link's target instead of the intended path. In this case a low-privileged attacker sets up a link that redirects a file operation performed by the Windows Update stack, causing that privileged operation to act on a file the attacker chooses. The result is elevation to SYSTEM.

Attack characteristics:

• Authentication: local, low-privileged account required
• User interaction: none
• Vector: local (AV:L)
• Impact: elevation of privilege to SYSTEM (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

As a local elevation-of-privilege bug, this is not an initial-access vector on its own. Its role is the second stage of an intrusion: after phishing or another RCE gives an attacker a normal user context, this flaw provides the jump to full system control.

Discovery

Microsoft credited Romain Deperne of Airbus Helicopters and the Microsoft Threat Intelligence Center (MSTIC). MSTIC's involvement is consistent with the bug being found through investigation of real attacks.

Exploitation Context

Microsoft marked the vulnerability as exploited at release, one of two Windows elevation-of-privilege zero-days in the September 2026 Patch Tuesday. That release was record-sized, with reporting citing roughly 964 to 974 CVEs overall. Microsoft did not disclose the threat actor, method, or scale. No public proof of concept was reported at disclosure.

Remediation

1. Apply the September 2026 cumulative update for the affected Windows and Windows Server version immediately. This is the only fix; there is no configuration workaround.
2. Prioritize by role in the kill chain. Because this is a local privilege escalation, focus first on systems where users run untrusted content or where initial-access risk is highest, since the bug is most dangerous once an attacker already has a foothold.
3. Monitor for post-compromise indicators: anomalous SYSTEM-level file modifications and unexpected privilege elevations associated with Windows Update processes.
4. Patch the companion zero-day CVE-2026-85880 (ALPC heap overflow) in the same cycle; both were exploited and both are covered by the September cumulative updates.