{"id":"CVE-2026-81963","title":"Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.","summary":"Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-59","CWE-284"],"vendor":"microsoft","product":"windows_11_23h2","affected":["windows_11_23h2 < 10.0.22631.7582","windows_11_24h2 < 10.0.26100.9445","windows_11_25h2 < 10.0.26200.9445","windows_11_26h1 < 10.0.28000.2954","windows_server_2025 < 10.0.26100.33438"],"patched":["windows_11_23h2 10.0.22631.7582","windows_11_24h2 10.0.26100.9445","windows_11_25h2 10.0.26200.9445","windows_11_26h1 10.0.28000.2954","windows_server_2025 10.0.26100.33438"],"published":"2026-09-08","updated":"2026-09-09","sourceUpdated":"2026-09-09T05:18:17.173","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81963","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963","label":"secure@microsoft.com"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","in-the-wild","exploit-available","kev"],"exploited":true,"exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total","timestamp":"2026-09-08T18:44:08.999075Z"},"kev":true,"kevDateAdded":"2026-09-08","kevDueDate":"2026-09-22","kevRansomware":false,"zeroDay":true,"ingestedAt":"2026-09-08T19:08:49.632Z","epss":0.00631,"epssPercentile":0.48518,"slug":"CVE-2026-81963","body":"## Overview\n\nImproper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.\n\n## Affected\n\n- `windows_11_23h2 < 10.0.22631.7582`\n- `windows_11_24h2 < 10.0.26100.9445`\n- `windows_11_25h2 < 10.0.26200.9445`\n- `windows_11_26h1 < 10.0.28000.2954`\n- `windows_server_2025 < 10.0.26100.33438`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `windows_11_23h2 10.0.22631.7582`\n- `windows_11_24h2 10.0.26100.9445`\n- `windows_11_25h2 10.0.26200.9445`\n- `windows_11_26h1 10.0.28000.2954`\n- `windows_server_2025 10.0.26100.33438`","depth":"abyssal","depthScore":68,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":25,"ransomware":0},"changes":[{"seq":202009,"id":"CVE-2026-81963","ts":1789400002798,"field":"zero_day","old":"false","new":"true"},{"seq":202008,"id":"CVE-2026-81963","ts":1789400002798,"field":"kev","old":"false","new":"true"},{"seq":200736,"id":"CVE-2026-81963","ts":1789397588586,"field":"zero_day","old":"true","new":"false"},{"seq":200735,"id":"CVE-2026-81963","ts":1789397588586,"field":"kev","old":"true","new":"false"},{"seq":199431,"id":"CVE-2026-81963","ts":1789395506025,"field":"zero_day","old":"false","new":"true"},{"seq":199430,"id":"CVE-2026-81963","ts":1789395506025,"field":"kev","old":"false","new":"true"},{"seq":198676,"id":"CVE-2026-81963","ts":1789392190854,"field":"zero_day","old":"true","new":"false"},{"seq":198675,"id":"CVE-2026-81963","ts":1789392190854,"field":"kev","old":"true","new":"false"},{"seq":197007,"id":"CVE-2026-81963","ts":1789384277770,"field":"zero_day","old":"false","new":"true"},{"seq":197006,"id":"CVE-2026-81963","ts":1789384277770,"field":"kev","old":"false","new":"true"},{"seq":196367,"id":"CVE-2026-81963","ts":1789383752000,"field":"zero_day","old":"true","new":"false"},{"seq":196366,"id":"CVE-2026-81963","ts":1789383752000,"field":"kev","old":"true","new":"false"},{"seq":195295,"id":"CVE-2026-81963","ts":1789380559456,"field":"zero_day","old":"false","new":"true"},{"seq":195294,"id":"CVE-2026-81963","ts":1789380559456,"field":"kev","old":"false","new":"true"},{"seq":194138,"id":"CVE-2026-81963","ts":1789378737075,"field":"zero_day","old":"true","new":"false"},{"seq":194137,"id":"CVE-2026-81963","ts":1789378737075,"field":"kev","old":"true","new":"false"},{"seq":192925,"id":"CVE-2026-81963","ts":1789376500389,"field":"zero_day","old":"false","new":"true"},{"seq":192924,"id":"CVE-2026-81963","ts":1789376500389,"field":"kev","old":"false","new":"true"},{"seq":191712,"id":"CVE-2026-81963","ts":1789373593783,"field":"zero_day","old":"true","new":"false"},{"seq":191711,"id":"CVE-2026-81963","ts":1789373593783,"field":"kev","old":"true","new":"false"},{"seq":190497,"id":"CVE-2026-81963","ts":1789369457224,"field":"zero_day","old":"false","new":"true"},{"seq":190496,"id":"CVE-2026-81963","ts":1789369457224,"field":"kev","old":"false","new":"true"},{"seq":189284,"id":"CVE-2026-81963","ts":1789368376034,"field":"zero_day","old":"true","new":"false"},{"seq":189283,"id":"CVE-2026-81963","ts":1789368376034,"field":"kev","old":"true","new":"false"},{"seq":188067,"id":"CVE-2026-81963","ts":1789365223187,"field":"zero_day","old":"false","new":"true"},{"seq":188066,"id":"CVE-2026-81963","ts":1789365223187,"field":"kev","old":"false","new":"true"},{"seq":186854,"id":"CVE-2026-81963","ts":1789363457458,"field":"zero_day","old":"true","new":"false"},{"seq":186853,"id":"CVE-2026-81963","ts":1789363457458,"field":"kev","old":"true","new":"false"},{"seq":185640,"id":"CVE-2026-81963","ts":1789361210652,"field":"zero_day","old":"false","new":"true"},{"seq":185639,"id":"CVE-2026-81963","ts":1789361210652,"field":"kev","old":"false","new":"true"},{"seq":184427,"id":"CVE-2026-81963","ts":1789358323976,"field":"zero_day","old":"true","new":"false"},{"seq":184426,"id":"CVE-2026-81963","ts":1789358323976,"field":"kev","old":"true","new":"false"},{"seq":182678,"id":"CVE-2026-81963","ts":1789354308469,"field":"zero_day","old":"false","new":"true"},{"seq":182677,"id":"CVE-2026-81963","ts":1789354308469,"field":"kev","old":"false","new":"true"},{"seq":181471,"id":"CVE-2026-81963","ts":1789353293087,"field":"zero_day","old":"true","new":"false"},{"seq":181470,"id":"CVE-2026-81963","ts":1789353293087,"field":"kev","old":"true","new":"false"},{"seq":180264,"id":"CVE-2026-81963","ts":1789350270916,"field":"zero_day","old":"false","new":"true"},{"seq":180263,"id":"CVE-2026-81963","ts":1789350270916,"field":"kev","old":"false","new":"true"},{"seq":179057,"id":"CVE-2026-81963","ts":1789348259647,"field":"zero_day","old":"true","new":"false"},{"seq":179056,"id":"CVE-2026-81963","ts":1789348259647,"field":"kev","old":"true","new":"false"},{"seq":177850,"id":"CVE-2026-81963","ts":1789346361227,"field":"zero_day","old":"false","new":"true"},{"seq":177849,"id":"CVE-2026-81963","ts":1789346361227,"field":"kev","old":"false","new":"true"},{"seq":176643,"id":"CVE-2026-81963","ts":1789343159873,"field":"zero_day","old":"true","new":"false"},{"seq":176642,"id":"CVE-2026-81963","ts":1789343159873,"field":"kev","old":"true","new":"false"},{"seq":174760,"id":"CVE-2026-81963","ts":1789334858185,"field":"zero_day","old":"false","new":"true"},{"seq":174759,"id":"CVE-2026-81963","ts":1789334858185,"field":"kev","old":"false","new":"true"},{"seq":173555,"id":"CVE-2026-81963","ts":1789333670787,"field":"zero_day","old":"true","new":"false"},{"seq":173554,"id":"CVE-2026-81963","ts":1789333670787,"field":"kev","old":"true","new":"false"},{"seq":172369,"id":"CVE-2026-81963","ts":1789331085267,"field":"zero_day","old":"false","new":"true"},{"seq":172368,"id":"CVE-2026-81963","ts":1789331085267,"field":"kev","old":"false","new":"true"}]}