CVE-2026-81963: A Link Following Flaw in the Windows Update Stack Reaches SYSTEM

The updater that already runs with the highest authority

The Windows Update Stack runs as a service with privileges that ordinary processes do not have. It resolves files and writes them during servicing operations, which means it handles untrusted path input at system level. CVE-2026-81963 is a link following defect in exactly that path.
CISA added the flaw to the Known Exploited Vulnerabilities catalog on 8 September 2026 with a due date of 22 September. NVD records a CVSS 3.1 base score of 7.8 with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

What the vulnerability is

NVD describes improper link resolution before file access, the link following class, in the Windows Update Stack. An authorized attacker can elevate privileges locally. The CISA description states the outcome as local escalation to SYSTEM.
The requirements are low. The attacker needs local access and low privileges, no user interaction, and no special conditions. The impact is rated high across confidentiality, integrity and availability because SYSTEM reaches everything on the host.

Why a local flaw on the patch path accumulates risk

Local privilege escalation is only dangerous when an attacker already holds an account, which is why the score sits below the remote code execution band. The accounting changes at fleet scale.
Almost every compromised endpoint begins with a low-privileged foothold: a phishing payload running as a standard user, a service account with weak credentials, or a container escaping to the host. A reliable local escalation turns that foothold into full control of the machine, and on a domain-joined host, into a position for lateral movement.
A flaw in the update stack adds a second consideration. Update components run during maintenance windows, often with the machine under administrative control and with logging focused on the update process rather than on intrusion detection. A flaw in that path can be exercised at a moment when attention and tooling are pointed elsewhere.
CISA lists a separate Windows ALPC elevation flaw, CVE-2026-85880, on the same day, which suggests a coordinated set of local escalation bugs rather than an isolated case.

Remediation

Apply the Microsoft security update associated with CVE-2026-81963 from the MSRC guidance and confirm the installed update level on endpoints, including servers that receive updates through a managed pipeline.
Where immediate fleet-wide patching is impossible, reduce the number of accounts with interactive local logon rights on high-value systems. The vulnerability needs a local foothold; fewer footholds reduce the exposure while the patch rolls out.
Review endpoints for indicators of post-exploitation. Link following defects commonly leave unusual symbolic links or junction points in temporary and update directories, and they typically appear alongside attempts to run tools as SYSTEM. Correlate local account activity with process creations that do not match an administrative maintenance plan.
Verify the patch after deployment. Because this class of flaw is a race against a privileged service rather than a visible version check, confirm both the installed build and the absence of the temp-path artifacts the exploitation pattern relies on.

References

• Microsoft Security Response Center, CVE-2026-81963: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963
• NVD, CVE-2026-81963: https://nvd.nist.gov/vuln/detail/CVE-2026-81963
• CISA Known Exploited Vulnerabilities Catalog, CVE-2026-81963: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963