Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-81963

Published 2026-09-08

Updated last month

Vendor/s

Microsoft

Product/s

Windows

Version/s

\* > 10.0.22631.7582

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

7.8

/ 10

High

Severity Details

Base score

7.8 High

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-81963 is a high-severity privilege escalation vulnerability in Windows Update Stack. Patch Windows 11 and Server 2025 systems immediately.

## Why this matters

"CVE-2026-81963 is a high-severity local privilege escalation vulnerability in the Microsoft Windows Update Stack, carrying a CVSS score of 7.8. This vulnerability is particularly critical as it is actively exploited and listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog. The flaw allows an authorized local attacker to exploit improper link resolution to gain elevated system privileges. In a typical attack scenario, a threat actor with a low-privilege foothold can use this vulnerability to bypass security boundaries and take full control of the affected Windows 11 or Windows Server 2025 system."

## CPE

Microsoft

| Product               | Version Start | Version End (excl.) | Status     |
| --------------------- | ------------- | ------------------- | ---------- |
| windows\_11\_23h2     | \*            | 10.0.22631.7582     | vulnerable |
| windows\_11\_23h2     | \*            | 10.0.22631.7582     | vulnerable |
| windows\_11\_24h2     | \*            | 10.0.26100.9445     | vulnerable |
| windows\_11\_24h2     | \*            | 10.0.26100.9445     | vulnerable |
| windows\_11\_25h2     | \*            | 10.0.26200.9445     | vulnerable |
| windows\_11\_25h2     | \*            | 10.0.26200.9445     | vulnerable |
| windows\_11\_26h1     | \*            | 10.0.28000.2954     | vulnerable |
| windows\_11\_26h1     | \*            | 10.0.28000.2954     | vulnerable |
| windows\_server\_2025 | \*            | 10.0.26100.33438    | vulnerable |

## Related weakness (CWE)

CWE-59, CWE-284

## Remediation plan

1

### Apply official patches

Immediately download and install the security updates provided by Microsoft through the MSRC portal to address the link following vulnerability in the Windows Update Stack.

2

### Update affected systems

Ensure all Windows 11 systems are updated to versions higher than 10.0.22631.7582 (23H2), 10.0.26100.9445 (24H2/25H2), or 10.0.28000.2954 (26H1), and Windows Server 2025 is updated beyond 10.0.26100.33438.

3

### Restrict access

Limit local access to sensitive systems and enforce the principle of least privilege (PoLP) to prevent unauthorized users from executing the local commands required to trigger the vulnerability.

4

### Monitor for exploitation

Deploy EDR signatures to detect the creation of suspicious symbolic links or NTFS junctions within system-level update directories, which are common indicators of this exploit technique.

## Detection Guidance

"Security teams should monitor for unusual file system activity, specifically the creation of symbolic links or junctions by non-administrative users in Windows Update directories. Audit Windows Event Logs for Event ID 4663 (file access) and 4656 (object handle requests) targeting system files. Network-level detection is less effective due to the local nature of the attack, so focus on host-based telemetry for unexpected privilege transitions."

## References

[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963 Patch Vendor Advisory ](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-81963 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)