Advisory · CVE-2026-81963
Windows Update flaw lets local users climb to SYSTEM
A link-following flaw in the Windows Update Stack lets a local attacker escalate to SYSTEM. Microsoft patched it on September 8, 2026, and confirms it was exploited as a zero-day.
- Vendor
- Microsoft
- Product
- Windows
- Identifier / CWE
- CVE-2026-81963
CWE-59 - Action timing
- Sep 29, 2026
Explain it like I’m five
The building's maintenance crew follows signs to find which closet to clean. An attacker swaps the signs, so the crew walks into the vault and does its privileged cleaning there, using the crew's master access.
- 01Link planted
A low-privilege local attacker places a symbolic link or junction at a location the Update Stack will touch.
- 02Update runs
The Windows Update Stack performs file operations with elevated privileges.
- 03Link followed
The service resolves the attacker's link without adequate validation and acts on the wrong target.
- 04SYSTEM reached
The redirected privileged file operation gives the attacker SYSTEM-level control of the machine.
What happened
Microsoft’s September 8, 2026 Patch Tuesday fixed CVE-2026-81963, an elevation-of-privilege vulnerability in the Windows Update Stack caused by improper link resolution before file access (CWE-59, commonly called link following). The Windows Update Stack performs file operations with elevated privileges without adequately validating whether paths resolve through symbolic links, junctions, or hard links. A local, authorized attacker can plant a crafted link so the service operates against an attacker-chosen target, escalating from a standard user account to SYSTEM. Microsoft lists the vulnerability as exploited in the wild and credits Romain Deperne and the Microsoft Threat Intelligence Center with the report. It carries CVSS 7.8 and affects Windows 11 and Windows Server 2025. There is no workaround. Researchers note this is the first exploited zero-day in a line of Windows Update Stack privilege-escalation flaws tracked since 2022. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 8, 2026.
What to do
- Install the September 2026 Windows security updates on all affected Windows 11 and Windows Server 2025 systems; there is no workaround.
- Prioritize multi-user workstations, shared systems, and endpoints where local code execution paths exist, such as machines reachable by phishing-delivered malware.
- Review the period before patching for signs of follow-on activity: this flaw is a second-stage primitive, so pair the update with hunting for the initial foothold (malicious documents, browser exploits, or credential-based access) that could have used it.
- Confirm update compliance by build, since servicing baselines and supersedence can shift which cumulative update carries the fix.
Management note
This flaw does not break in remotely, it finishes the job after something else gets a foothold, which is exactly how modern intrusion chains work: a phishing click plus a local privilege escalation equals full host control. Microsoft confirmed real-world exploitation, and the fix is a standard Patch Tuesday update with no workaround. The risk is not the score, it is the role this bug plays in turning minor incidents into domain-wide ones.