Windows Update Stack local privilege escalation (CVE-2026-81963)

Actively exploited in the wild - CVE-2026-81963 is a high-severity local privilege escalation in the Windows Update Stack that lets an authorized attacker with low privileges gain SYSTEM-level control of a machine. No standalone patch is available; apply Microsoft’s guidance and monitor for indicators.

Overview

CVE-2026-81963 is an improper link resolution before file access vulnerability, a class commonly known as a “link following” or symbolic link attack. When the Windows Update Stack processes certain file operations, it fails to properly verify the target of a link. An attacker who can already run code on a system as a low-privileged user can exploit this weakness by placing a malicious link in a location the Windows Update Stack accesses. When the component follows that link, it performs actions with elevated privileges, allowing the attacker to overwrite or replace critical system files and escalate to full SYSTEM rights.

The vulnerability carries a CVSS score of 7.8 (High) due to the low attack complexity and the fact that no user interaction is required beyond the initial foothold. Its presence on CISA’s Known Exploited Vulnerabilities (KEV) catalog confirms that threat actors are already using it in live attacks.

Impact

Successful exploitation grants complete control of the affected Windows endpoint. An attacker with SYSTEM privileges can install malware, create new user accounts with administrative rights, disable security tools, and move laterally across the network using stolen credentials. The low complexity and availability of public exploit techniques make this a high-priority risk for any organization running Windows endpoints.

Remediation and Mitigation

Microsoft has not yet released a dedicated standalone patch for CVE-2026-81963. Until an update is available through Windows Update or the Microsoft Security Response Center, take these steps:

• Apply all pending Windows Update Stack and cumulative OS updates, as they may contain hardening improvements.
• Restrict local user privileges where possible and enforce the principle of least privilege on endpoints.
• Deploy endpoint detection and response (EDR) tools and monitor for anomaly file operations or symbolic link creation in Windows Update directories.
• Review Microsoft’s official advisory for workarounds and detection guidance.
• Review the Lazarus exploits Windows zero-day in Dream Job attacks report, as the exploit chain shows how such local escalation flaws are weaponized against defense sector targets.

Security Insight

The active exploitation of this Windows Update Stack flaw before a patch is available underscores an unwelcome pattern: the update mechanism itself is becoming an attack surface. Similar to the Russian CTRL Toolkit Hijacks RDP via Malicious LNK campaign, this vulnerability demonstrates that low-privilege file-system interactions remain a fertile ground for escalation. It is a reminder that while Microsoft has improved Smart App Control with releases like Windows 11 KB5079391 update rolls out Smart App Control, the foundational file-handling code paths continue to be a weak point that attackers will probe until hardened.

Further Reading

• Lazarus exploits Windows zero-day in Dream Job attacks
• Russian CTRL Toolkit Hijacks RDP via Malicious LNK
• Windows 11 KB5079391 update rolls out Smart App Control
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs