CVE-2026-81963

Published Sep 8, 2026

Last updated 7 hours ago

Exploit known CVSS high 7.8

Overview

Description: Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
Source: secure@microsoft.com
NVD status: Analyzed
Products: windows_11_23h2, windows_11_24h2, windows_11_25h2, windows_11_26h1, windows_server_2025

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Microsoft Windows Link Following Vulnerability
Exploit added on: Sep 8, 2026
Exploit action due: Sep 22, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

secure@microsoft.com: CWE-59

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "97D353CE-F9A4-46B5-BC5C-BF422E10785D",
            "versionEndExcluding": "10.0.22631.7582",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "A2B42421-4694-4879-A69B-6A9192E2CFB8",
            "versionEndExcluding": "10.0.22631.7582",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "990434BE-FE81-48CC-8803-94FAEB694DE2",
            "versionEndExcluding": "10.0.26100.9445",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "045BBF02-6FDD-44D4-B278-0C52A5406956",
            "versionEndExcluding": "10.0.26100.9445",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "948460EF-4053-4106-8D9E-4EDC3BF7B682",
            "versionEndExcluding": "10.0.26200.9445",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "D4F1D717-582C-446B-B90F-1D25028DA77F",
            "versionEndExcluding": "10.0.26200.9445",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "4B46D2B8-7E89-4818-862C-30B9751BA6EA",
            "versionEndExcluding": "10.0.28000.2954",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "165C7909-F15B-4328-A175-B9FEF3BEB82D",
            "versionEndExcluding": "10.0.28000.2954",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "48D75543-6B91-41E9-A1FB-1A09A2CBD738",
            "versionEndExcluding": "10.0.26100.33438",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References