CVE-2026-81963ImportantExploitedCISA KEV · due 22 SepRevised 15 Sep

Windows Update Stack Elevation of Privilege Vulnerability

Listed in the CISA Known Exploited Vulnerabilities catalog

Added 8 Sep 2026 · federal remediation due 22 Sep 2026.

Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.

Assessment

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

Severity: Important
CVSS base score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Impact: Elevation of Privilege
EPSS, next 30 days: 0.4%Higher than 30.9% of scored CVEs · FIRST model run 26 Sep 2026 · about EPSS
Exploitability: Exploitation detected
Publicly disclosed: No
Customer action: Required: apply the update
Component: Windows Update Stack
Weakness: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Issued by: Microsoft
Published: 8 Sep 2026 · September 2026
Last revised: 15 Sep 2026Updated an acknowledgement. This is an informational change only.

4 KBs

KB	Type	Restart	Applies to	Other CVEs
KB5122871	Security Update	Required	Windows Server 2025, Windows Server 2025 (Server Core installation)	All CVEs in KB5122871
KB5122880	Security Update	Required	Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems	All CVEs in KB5122880
KB5124008	Security Update	Required	Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems and 1 more	All CVEs in KB5124008
KB5124012	Security Update	Required	Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems	All CVEs in KB5124012

Windows

10 affected products