Summary
generated automatically from NVD dataCVE-2026-81963 is a link-following flaw (CWE-59) in the Windows Update Stack, where a link is improperly resolved before file access. A locally authorized attacker can exploit it to elevate privileges. It affects Windows 11 versions 23H2, 24H2, 25H2 and 26H1, as well as Windows Server 2025. It is rated CVSS v3.1 7.8 (HIGH), and CISA's KEV catalog lists it as actively exploited.
NVD description
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-08. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-09-22
EPSS · FIRST.org
0.39%probability of exploitation in the next 30 days
Higher than 31% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 8 sept. 2026
- Updated
- 9 sept. 2026
- Status
- Analyzed
- Source
- secure@microsoft.com
Affected products
Weaknesses (CWE)
References (2)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963PatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-59
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.