CVE-2026-81963
Description
CVE-2026-81963 is a high-severity privilege escalation vulnerability in Windows Update Stack. Patch Windows 11 and Server 2025 systems immediately.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| windows_11_23h2 | * | 10.0.22631.7582 | vulnerable |
| windows_11_23h2 | * | 10.0.22631.7582 | vulnerable |
| windows_11_24h2 | * | 10.0.26100.9445 | vulnerable |
| windows_11_24h2 | * | 10.0.26100.9445 | vulnerable |
| windows_11_25h2 | * | 10.0.26200.9445 | vulnerable |
| windows_11_25h2 | * | 10.0.26200.9445 | vulnerable |
| windows_11_26h1 | * | 10.0.28000.2954 | vulnerable |
| windows_11_26h1 | * | 10.0.28000.2954 | vulnerable |
| windows_server_2025 | * | 10.0.26100.33438 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately download and install the security updates provided by Microsoft through the MSRC portal to address the link following vulnerability in the Windows Update Stack.
Update affected systems
Ensure all Windows 11 systems are updated to versions higher than 10.0.22631.7582 (23H2), 10.0.26100.9445 (24H2/25H2), or 10.0.28000.2954 (26H1), and Windows Server 2025 is updated beyond 10.0.26100.33438.
Restrict access
Limit local access to sensitive systems and enforce the principle of least privilege (PoLP) to prevent unauthorized users from executing the local commands required to trigger the vulnerability.
Monitor for exploitation
Deploy EDR signatures to detect the creation of suspicious symbolic links or NTFS junctions within system-level update directories, which are common indicators of this exploit technique.
Detection Guidance
"Security teams should monitor for unusual file system activity, specifically the creation of symbolic links or junctions by non-administrative users in Windows Update directories. Audit Windows Event Logs for Event ID 4663 (file access) and 4656 (object handle requests) targeting system files. Network-level detection is less effective due to the local nature of the attack, so focus on host-based telemetry for unexpected privilege transitions."