Microsoft Windows Link Following Vulnerability
TL;DR 📌
- Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.
- Highest CVSS: 7.8 (High).
- Listed in CISA KEV (2026-09-08) — this is being exploited in the wild.
- Fixed in
10.0.22631.7582,10.0.26100.33438,10.0.26100.9445,10.0.26200.9445— upgrade to this release or later. - CVEs: CVE-2026-81963.
What it is
CVE-2026-81963 is a link-following vulnerability in the Windows Update Stack. The flaw is in how the update stack resolves file links before acting on them: if it follows a symbolic link or junction it shouldn’t, an operation intended for one file path can be redirected to another, including locations a normal user shouldn’t be able to touch.
The attacker needs local access and low-level privileges already (PR:L), plus no user interaction is required beyond that (UI:N). This is a local privilege escalation path, not something reachable over the network — the CVSS vector confirms local attack vector with low complexity. A logged-on standard user exploiting a race or predictable path in the update stack’s file handling can redirect a privileged file operation to escalate to SYSTEM.
Impact is a full compromise of confidentiality, integrity and availability at the SYSTEM level (C:H/I:H/A:H), which on Windows means the attacker moves from a limited local account to complete control of the host.
This CVE is in CISA’s Known Exploited Vulnerabilities catalogue, added 8 September 2026. That confirms it is being exploited; the advisory says nothing further about how, so don’t extrapolate beyond that.
What to do
- Patch to the fixed build for your branch: 10.0.22631.7582, 10.0.26100.33438, 10.0.26100.9445, 10.0.26200.9445, or 10.0.28000.2954, depending on which Windows version and servicing branch you run. Check Windows Update or your patch management console against these build numbers to confirm you’ve cleared the vulnerable range.
- Given the KEV listing, treat this as a priority patch, not routine maintenance — apply to internet-facing and multi-user systems first, where a compromised local account has the most value to an attacker.
- Since exploitation requires existing local, low-privilege access, review and tighten who has interactive logon rights on affected machines as a compensating control while patches roll out.
- Audit endpoint detection for unusual symbolic link or junction creation activity tied to the Windows Update Stack’s working directories, as a way of catching exploitation attempts on unpatched hosts.
- Confirm patch deployment through your usual compliance reporting; there is no workaround listed beyond installing the fix, so unpatched systems remain exposed until updated.
For leadership 🧭
Executive summary. An attacker who already has a low-privilege local logon on a Windows host can exploit this flaw in the update stack to gain full SYSTEM control, and it is confirmed as actively exploited via CISA’s KEV listing. Given that confirmed exploitation, patching should be treated as urgent rather than folded into routine update cycles.
Why it matters:
- The flaw sits in the Windows Update Stack’s file-link handling, so any Windows host that receives updates is a candidate for exploitation once an attacker has any local low-privilege foothold.
- No user interaction beyond existing local access is needed, and the outcome is full SYSTEM-level compromise of confidentiality, integrity and availability — a complete takeover from a standard account.
- Multi-user systems (shared workstations, terminal servers, jump boxes) carry the highest risk because they’re exactly where an attacker is most likely to already hold a low-privilege local account to exploit.
- This CVE is in CISA’s KEV catalogue as of 8 September 2026, meaning it is confirmed as exploited in the wild, not just theoretical.
Now / Next / Later:
- Now: Check Windows Update or your patch management console against the fixed build numbers (10.0.22631.7582, 10.0.26100.33438, 10.0.26100.9445, 10.0.26200.9445, 10.0.28000.2954) to identify unpatched hosts, prioritising multi-user and internet-facing systems.
- Next: Roll out the applicable fixed build to all affected Windows systems in the next patch window, and in the meantime tighten who holds interactive logon rights on machines awaiting patching.
- Later: Add symbolic link/junction creation activity in Windows Update Stack working directories to endpoint detection monitoring, and fold build-number verification for this class of fix into routine patch compliance reporting.