Microsoft Windows Update Stack Link-Following Privilege Escalation

Windows Update Stack contains an improper link resolution vulnerability (link following) that allows a local attacker to escalate privileges to SYSTEM level.

Link following, classified under CWE-59, occurs when a privileged process follows a symbolic link or junction point without first confirming that the target path is one it should act on. The Windows Update Stack runs with elevated privileges to manage patch staging and installation. If an attacker places a controlled symlink at a path the stack normally writes to, that write gets redirected to an arbitrary target, overwriting system files or registry entries that control execution. With write access to privileged system objects, the attacker can reach SYSTEM-level access.

The Windows Update Stack is the component responsible for staging, validating, and applying updates through Windows Update. It runs as a trusted service with access to protected directories and does not require any elevated starting point from the attacking process. A user with only standard account access can trigger the flaw; no administrator rights or unusual system configuration are needed.

Patched September 8, 2026 as part of Microsoft’s record September Patch Tuesday, which addressed 974 CVEs total. CISA added CVE-2026-81963 to its Known Exploited Vulnerabilities catalog the same day. Federal agencies must apply mitigations by September 22, 2026 per BOD 26-04.

CVE-2026-81963 and CVE-2026-85880, a Windows ALPC heap buffer overflow with the same CVSS 7.8 severity rating, were both patched on September 8 and added to CISA KEV in the same update batch. Both are local privilege escalation flaws with no direct remote exploitation path. CISA’s active-exploitation confirmation on both means they are used in real intrusions, typically as the privilege escalation step after an initial foothold has been established by other means. A chain pairing remote code execution with either LPE gives an attacker a path from initial access to full system control.

This flaw is not directly remotely exploitable on its own. Local access on the target machine is a required starting condition. Apply the September 8, 2026 cumulative Windows update to close the vector. Microsoft’s update documentation lists the specific KB article for each supported Windows release.

CISA added two other vulnerabilities in the same September 8 KEV batch that warrant parallel urgency: CVE-2026-75650, a CVSS 10.0 template-engine injection in Adobe Commerce under active exploitation, and CVE-2026-86218, a CVSS 10.0 pre-authentication RCE in N-able N-central.

For full Patch Tuesday context, see Microsoft Patches Record 974 Vulns, 2 Zero-Days.

FAQ

Does this vulnerability affect Windows home users, or only enterprise systems?

Both. The Windows Update Stack runs on every supported Windows version, including Windows 10 and 11 home editions. CISA’s KEV deadline covers federal agencies, but any Windows system with local user access is in scope. Apply the September 8, 2026 cumulative update through Windows Update on home and enterprise machines alike.

Can an attacker exploit this remotely, without physical or network access?

No, not on its own. CVE-2026-81963 requires an attacker who already has local code execution on the target machine. That precondition is typically met through an earlier stage of an attack chain, such as phishing, a browser exploit, or an RCE vulnerability in another application. Once local access exists, this flaw provides the path from a standard user account to SYSTEM-level control. CISA’s active-exploitation confirmation means these chains are in use in real intrusions.

Does patching CVE-2026-81963 also fix CVE-2026-85880?

Yes. CVE-2026-85880, the Windows ALPC heap buffer overflow that allows AppContainer sandbox escape to privilege escalation, was also patched in the same September 8, 2026 cumulative Windows update. A single update application closes both local privilege escalation vectors at once. Confirm your Windows Update history shows the September 8 KB article for your release as installed.