Microsoft Windows Update Stack Link-Following Privilege Escalation

Windows Update Stack contains an improper link resolution vulnerability (link following) that allows a local attacker to escalate privileges to SYSTEM level.

Link following, classified under CWE-59, occurs when a privileged process follows a symbolic link or junction point without first confirming that the target path is one it should act on. The Windows Update Stack runs with elevated privileges to manage patch staging and installation. If an attacker places a controlled symlink at a path the stack normally writes to, that write gets redirected to an arbitrary target, overwriting system files or registry entries that control execution. With write access to privileged system objects, the attacker can reach SYSTEM-level access.

The Windows Update Stack is the component responsible for staging, validating, and applying updates through Windows Update. It runs as a trusted service with access to protected directories and does not require any elevated starting point from the attacking process. A user with only standard account access can trigger the flaw; no administrator rights or unusual system configuration are needed.

Patched September 8, 2026 as part of Microsoft’s record September Patch Tuesday, which addressed 974 CVEs total. CISA added CVE-2026-81963 to its Known Exploited Vulnerabilities catalog the same day. Federal agencies must apply mitigations by September 22, 2026 per BOD 26-04.

CVE-2026-81963 and CVE-2026-85880, a Windows ALPC heap buffer overflow with the same CVSS 7.8 severity rating, were both patched on September 8 and added to CISA KEV in the same update batch. Both are local privilege escalation flaws with no direct remote exploitation path. CISA’s active-exploitation confirmation on both means they are used in real intrusions, typically as the privilege escalation step after an initial foothold has been established by other means. A chain pairing remote code execution with either LPE gives an attacker a path from initial access to full system control.

This flaw is not directly remotely exploitable on its own. Local access on the target machine is a required starting condition. Apply the September 8, 2026 cumulative Windows update to close the vector. Microsoft’s update documentation lists the specific KB article for each supported Windows release.

For full Microsoft Patch Tuesday context, see Microsoft Patches Record 974 Vulns, 2 Zero-Days.

September 8, 2026 CISA KEV Batch

CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog on September 8, 2026 in a single enforcement update. All four carry confirmed active-exploitation status. The two Windows CVEs (CVE-2026-81963 and CVE-2026-85880) share a September 22 remediation deadline; the other two carry a September 11 deadline:

• CVE-2026-75650: CVSS 10.0, Adobe Commerce and Magento Open Source template-engine injection, unauthenticated RCE, September 11 deadline
• CVE-2026-81963 (this entry): CVSS 7.8, Windows Update Stack link-following privilege escalation, September 22 deadline
• CVE-2026-85880: CVSS 7.8, Windows ALPC heap buffer overflow, AppContainer sandbox escape, September 22 deadline
• CVE-2026-86218: CVSS 10.0, N-able N-central pre-authentication RCE, September 11 deadline

CVE-2026-81963 and CVE-2026-85880 are often chained together in the same intrusion: one provides initial sandbox escape via ALPC, the other escalates from a standard user account to SYSTEM via the Windows Update Stack. A single September 8 cumulative update closes both.

FAQ

Does this vulnerability affect Windows home users, or only enterprise systems?

Both. The Windows Update Stack runs on every supported Windows version, including Windows 10 and 11 home editions. CISA’s KEV deadline covers federal agencies, but any Windows system with local user access is in scope. Apply the September 8, 2026 cumulative update through Windows Update on home and enterprise machines alike.

Can an attacker exploit this remotely, without physical or network access?

No, not on its own. CVE-2026-81963 requires an attacker who already has local code execution on the target machine. That precondition is typically met through an earlier stage of an attack chain, such as phishing, a browser exploit, or an RCE vulnerability in another application. Once local access exists, this flaw provides the path from a standard user account to SYSTEM-level control. CISA’s active-exploitation confirmation means these chains are in use in real intrusions.

Does patching CVE-2026-81963 also fix CVE-2026-85880?

Yes. CVE-2026-85880, the Windows ALPC heap buffer overflow that allows AppContainer sandbox escape to privilege escalation, was also patched in the same September 8, 2026 cumulative Windows update. A single update application closes both local privilege escalation vectors at once. Confirm your Windows Update history shows the September 8 KB article for your release as installed.