CVE-2026-81963

CVE-2026-81963 is a link following flaw (CWE-59) in the Windows Update Stack. Microsoft also maps it to improper access control (CWE-284). A standard local user can elevate to SYSTEM.

Microsoft fixed it on 8 September 2026, in the September Patch Tuesday updates. It scores the flaw CVSS 3.1 7.8 and rates it Important. NVD has analyzed the record and shows the same score.

Exploited before the fix. Microsoft marks it "Exploitation Detected": exploited yes, publicly disclosed no. That makes it a zero-day at release. CISA's SSVC entry also lists exploitation as active.

CISA KEV: listed as "Microsoft Windows Link Following Vulnerability". Added on 8 September 2026, federal due date 22 September 2026. Known ransomware use: Unknown.

Attacker model: the attacker needs a local account first. It is not a remote flaw. It is useful as a second stage, after malware runs or a low-privilege session is stolen.

Fixed builds

The fix covers x64 and ARM64. Later cumulative updates also include it.

Windows Server 2025 Server Core uses the same update and build.

Credits

Microsoft credits haowei yan, Zhang WangJunJie of Hillstone Networks, Romain DEPERNE, and the Microsoft Threat Intelligence Center (MSTIC). Revisions 1.1 to 1.4 (latest 7 October 2026) only changed acknowledgements.

PoC note (2 November 2026)

A third-party GitHub repository was published on 1 November 2026. Its author suspects it matches this CVE. Microsoft has not confirmed that. ThreatWire has not run or verified it.

The author says they reported the issue to Microsoft in July. Microsoft closed it on 29 October as low severity, defense in depth, with no CVE. The author is not among Microsoft's credits.

The repository claims an arbitrary file write as SYSTEM from a standard user, through the servicing stack and link tricks. We do not reprint any steps. Our source-only review found nothing malicious in the source. Its prebuilt binaries are unverified. Do not run them outside an isolated lab. The PoC link field points to the repository.

Facts checked on 2 November 2026.

What to do: install the September 2026 or a later cumulative update. Check that each device reports the fixed build or higher. The KEV due date has long passed. Our explainer covers the details. Related Windows privilege-escalation: CVE-2026-85884.