Patch Windows now: attackers exploited Update Stack flaw CVE-2026-81963 to gain SYSTEM

Timing: Microsoft fixed this flaw on 8 September 2026. A public PoC claim appeared on 1 November. We checked all facts on 2 November 2026.

What happened

A standard Windows user can take full SYSTEM control through a flaw in the Windows Update Stack. It is tracked as CVE-2026-81963.

Microsoft says attackers exploited it before the patch. Its advisory reads "Exploitation Detected". So it was a zero-day when the fix shipped.

The bug is a link following flaw. Windows can be tricked into following a file system link it should not trust. Microsoft scores it CVSS 7.8 and rates it Important.

Who is affected

Unpatched Windows 11 and Windows Server 2025 machines are affected:

• Windows 11 23H2: before build 10.0.22631.7582
• Windows 11 24H2: before 10.0.26100.9445
• Windows 11 25H2: before 10.0.26200.9445
• Windows 11 26H1: before 10.0.28000.2954
• Windows Server 2025 and Server Core: before 10.0.26100.33438

The attacker needs a local foothold first. That can be malware already running, or a stolen low-privilege session. The flaw then turns that foothold into full control. This makes it a typical second-stage bug.

What is confirmed

• Exploitation. Microsoft marks it exploited, not publicly disclosed. CISA's SSVC entry lists exploitation as active.
• CISA KEV. Added on 8 September 2026 as "Microsoft Windows Link Following Vulnerability". The federal due date was 22 September. Ransomware use is listed as Unknown.
• The fix. KB5122880 (23H2), KB5124008 (24H2 and 25H2), KB5124012 (26H1) and KB5122871 (Server 2025). Later cumulative updates also include it.
• The credits. haowei yan, Zhang WangJunJie of Hillstone Networks, Romain DEPERNE, and the Microsoft Threat Intelligence Center (MSTIC).
• A public repository. A third-party GitHub repository was published on 1 November 2026. The PoC link on this page points to it.

What is not confirmed

• That the PoC is this CVE. The author only suspects a match. Their README says "Suspected". Microsoft has not confirmed it.
• The author's report. The author says Microsoft closed their July report on 29 October as low severity, with no CVE. The author is not among Microsoft's credits.
• That the PoC works. It claims a SYSTEM-level file write from a standard user, using link tricks in the servicing stack. ThreatWire has not built, run or verified it. We do not reprint any steps.
• The binaries. The release ships prebuilt programs. They are unverified. Do not run them outside an isolated lab.
• Who attacked. Microsoft and CISA do not name the attackers or the targets.

What to do

1. Install the September 2026 or a later cumulative update on every Windows 11 and Server 2025 machine.
2. Check build numbers. Each device should report the fixed build above or higher. (ThreatWire advice.)
3. Treat late patching as urgent. The KEV due date of 22 September has long passed. Unpatched hosts are exposed to a known, used attack path. (ThreatWire advice.)
4. Hunt for footholds. On machines patched late, look for signs of prior compromise. The bug is used after initial access. (ThreatWire advice.)

Related Windows privilege-escalation: Windows 11 Health Service flaw CVE-2026-85884.

Sources

Record: CVE-2026-81963.

Sources: Microsoft MSRC, NVD, CVE.org, GitHub Advisory Database and the CISA KEV catalog. Links are in the references list.