CVE-2026-81963

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Sep 9, 2026

Description

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59 CWE-284

Affected software

Vendor	Product	Versions
Microsoft	Windows 11 version 23H2	>= 10.0.22631.0, < 10.0.22631.7582
Microsoft	Windows 11 Version 23H2	>= 10.0.22631.0, < 10.0.22631.7582
Microsoft	Windows 11 Version 24H2	>= 10.0.26100.0, < 10.0.26100.9445
Microsoft	Windows 11 Version 25H2	>= 10.0.26200.0, < 10.0.26200.9445
Microsoft	Windows 11 version 26H1	>= 10.0.28000.0, < 10.0.28000.2954
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.33438
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.33438

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963US Government Resource

Timeline

Published: Sep 8, 2026
Last modified: Sep 9, 2026
Added to CISA KEV: Sep 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-819645.5Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized attacker to bypass a security feature locally.CVE-2026-819697.8Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.CVE-2026-81974.8Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration na CVE-2026-819717.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to CVE-2026-819737.8Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current use CVE-2026-819757.8Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current use CVE-2026-819767.8Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current use CVE-2026-819775.5Acrobat Reader is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could lead to disclosure of sensitive memory. An CVE-2026-819785.5Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could lever CVE-2026-819797.8Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curre CVE-2026-81985.3The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass CVE-2026-819807.8Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curre