CVE-2026-81963: Microsoft Windows Update Stack Link Following Privilege Escalation (CWE-59)
Microsoft Windows Update Stack contains a link following flaw (CWE-59) that lets an authorized local user elevate privileges, with a CVSS 3.1 base score of 7.8 reported by the CNA. CISA has listed CVE-2026-81963 in the Known Exploited Vulnerabilities catalog, so affected systems should be prioritized for the vendor patch. The record lists affected Windows 11 and Windows Server 2025 builds with fixed build endpoints.
Overview
CVE-2026-81963 is a link following weakness (CWE-59) in the Windows Update Stack. Improper link resolution before file access lets an authorized attacker with local access elevate privileges. The vulnerability is published by Microsoft as a CNA and is tracked in the MSRC update guide.
Impact
The CNA vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, with a base score of 7.8 (High). The vector indicates local access, low complexity, low privileges required, no user interaction, unchanged scope, and high impact to confidentiality, integrity and availability. The description limits the impact to local privilege elevation.
Affected products and versions
The record lists the following affected Windows products and build ranges:
- Microsoft Windows 11 23H2: from 10.0.22631.0 before 10.0.22631.7582
- Microsoft Windows 11 24H2: from 10.0.26100.0 before 10.0.26100.9445
- Microsoft Windows 11 25H2: from 10.0.26200.0 before 10.0.26200.9445
- Microsoft Windows 11 26H1: from 10.0.28000.0 before 10.0.28000.2954
- Microsoft Windows Server 2025, including the Server Core installation: from 10.0.26100.0 before 10.0.26100.33438
Systems running builds at or above these endpoints are not listed as affected in the record. Verify your exact build number against the MSRC guidance.
Exploitation status
The CISA KEV entry shows this CVE as listed, with a date added of 2026-09-08 and a due date of 2026-09-22. Therefore active exploitation in the wild is reported by the KEV catalog. The SSVC exploitation field is also set to active, while automatable is no and ransomware use is unknown.
Remediation and mitigation
- Apply the Microsoft security update for the affected Windows builds listed in the MSRC advisory, as the record references a patch.
- Prioritize systems with local user access, shared workstations and servers with broad local logon rights.
- Follow the mitigation instructions provided by the vendor and the KEV required action, which refers to CISA BOD 26-04 guidance.
- If a patch cannot be applied, the KEV required action advises discontinuing use of the affected product until mitigations are available; confirm the vendor's interim options before acting.
Detection guidance
- Review endpoint and system logs for unexpected privilege changes or processes running with elevated rights on Windows 11 and Windows Server 2025 hosts.
- Inventory build numbers across the fleet to identify hosts below the fixed endpoints.
- Monitor for unusual file operations in update-related directories, reported at a high level, to support investigation.
Limitations of the available information
The record does not include technical detail on the exact file path, component behavior or trigger conditions, and it does not describe a proof of concept. The fix details beyond the patch reference are not provided in the record. The EPSS data is dated 2026-10-23, which is later than the publication date shown, so its timing should be confirmed against the source. Ransomware association is unknown.
Frequently asked questions
Is CVE-2026-81963 being actively exploited?
Yes, according to the CISA KEV entry in the record, which lists it with a date added of 2026-09-08 and a due date of 2026-09-22. The SSVC exploitation field is also marked active.
What does an attacker need to exploit this flaw?
The CNA vector indicates local access with low privileges and no user interaction. The record does not describe the exact conditions, and this portal does not provide exploitation details.
Which Windows versions are affected?
The record lists Windows 11 23H2, 24H2, 25H2 and 26H1, and Windows Server 2025 including Server Core, each with a build range ending before a fixed build number.
What should administrators do first?
Apply the Microsoft update for the affected builds, prioritize hosts with broad local access, and follow the vendor and KEV required-action guidance.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.