> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# CVE-2026-81963 — Microsoft Windows: Microsoft Windows Link Following Vulnerability
- URL: https://f4n6.co.uk/security-feed/cve-2026-81963-microsoft-windows-microsoft-windows-link-following-vulnerability/
- Published: 2026-09-08T20:21:14.000Z
- Updated: 2026-09-08T20:21:14.000Z
- Author: Jeff Davies
- Tags: #security-feed, CVE-2026-81963

## 1\. Executive summary

CVE-2026-81963 is a link following vulnerability (improper link resolution before file access; CWE-59 / CWE-284) in the Microsoft Windows Update Stack, rated CVSS 7.8 HIGH and added to the CISA Known Exploited Vulnerabilities catalogue on 2026-09-08\. A local, authenticated attacker with low privileges can abuse link-following behaviour to elevate to SYSTEM on affected Windows 11 and Windows Server 2025 hosts, including Server Core installations. Microsoft reports active exploitation in the wild; the flaw was not publicly disclosed before the 8 September 2026 Patch Tuesday, so defenders have no public PoC baseline — but adversaries already do. For EMEA financial services, this is a post-exploitation privilege-escalation primitive on the two most current Windows platforms in most estates; it converts any low-privilege foothold (phished user, malware dropper, malicious session on a terminal server) into full SYSTEM. CISA's KEV remediation due date is 2026-09-22.

## 2\. Regulatory framing

| Article                                                                     | Trigger (the fact in this item)                                                                                                                                                                                                                                               | Practical impact                                                                                                                                                                                         |
| --------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 24: digital operational resilience testing — general requirements | Confirmed in-the-wild exploitation of a privilege-escalation flaw in the Windows Update Stack on Windows 11 / Server 2025 means standard patch-deployment SLAs must be validated against a KEV-driven accelerated timeline (CISA due date 2026-09-22), not the routine cycle. | Use this KEV entry as a concrete test case in resilience testing: verify your organisation can identify, prioritise and patch KEV-listed Windows flaws estate-wide inside 14 days, and evidence the run. |
| DORA Art. 18: classification of ICT-related incidents and cyber threats     | A CISA-KEV-listed, actively exploited vulnerability affecting core endpoint/server platforms is a cyber threat requiring classification under your incident taxonomy, independent of any confirmed compromise.                                                                | Classify the KEV listing as a threat event now; upgrade to an ICT incident if exploitation evidence is found on any host during the P1 hunt.                                                             |

No NIS2 or UK NIS article is directly engaged beyond these triggers; the item is a vulnerability advisory, not a reportable incident, and no supply-chain or third-party fact specific to this item engages those scopes.

## 3\. Technical analysis & attack chain

**Vulnerability mechanism.** The Windows Update Stack performs file operations without correctly resolving links before file access (CWE-59, improper link resolution; NVD also classifies CWE-284, improper access control). A local attacker who can already execute code or otherwise operate on the filesystem as a low-privilege, authenticated user plants a link (e.g., symbolic link / junction-style artefacts) at a filesystem location the Update Stack subsequently writes to or reads from. Because the Update Stack's components run with SYSTEM privileges, the link redirects those privileged file operations onto attacker-chosen targets — the classic link-following primitive used to delete, replace or create files with SYSTEM-level rights, yielding local privilege escalation to SYSTEM. No user interaction beyond the attacker's own local session is required.

### Confirmed attack chain (as supported by source material)

1. Attacker obtains low-privilege, authenticated local code execution on an affected host (initial access vector is outside the scope of this CVE; the vulnerability itself is local-only).
2. Attacker creates a link structure at a path the Windows Update Stack accesses during its privileged operations.
3. Update Stack code, running as SYSTEM, follows the attacker-created link and performs the file operation against the attacker-chosen target.
4. Attacker leverages the redirected privileged write/read/delete to escalate from the low-privilege context to SYSTEM.

**Affected platforms (per SANS ISC):** Windows 11 and Windows Server 2025, including Server Core installations. The SANS report rates the flaw "Important" severity with CVSS 7.8, consistent with the verified NVD data.

**Observed impact:** Microsoft reports the vulnerability is being exploited in the wild. No further detail on the exploiting actors, payloads, or victimology is present in the source material; attribution is unconfirmed and no MITRE ATT&CK actor profile exists for this activity. Known ransomware campaign use is listed as Unknown in the CISA KEV entry — do not treat this as ransomware-linked.

**Context within the September 2026 Patch Tuesday.** This CVE ships in the largest Patch Tuesday on record — 973 vulnerabilities, 113 critical, per SANS ISC — and is one of two vulnerabilities Microsoft lists as exploited in the wild this cycle. The second, CVE-2026-85880 (Windows ALPC heap-based buffer overflow, CVSS 7.8, affecting Windows 10 and Server 2012/2016/2019/2022), allows an attacker running code in a low-privilege AppContainer to escape the sandbox to SYSTEM with no user interaction; Microsoft assesses it exploited in the wild but it was not in CISA's KEV catalogue at time of the SANS report. Both are local privilege-escalation primitives and should be treated as a pair for deployment prioritisation.

**Confidence caveat:** The affected-version list, exploitation status and mechanism detail above rest on the SANS ISC Patch Tuesday summary and the CISA KEV/NVD entries. No vendor advisory with exploit-specific technical detail (exact link path, abused Update Stack binary, PoC) is in the provided corpus; treat exploit-mechanism specifics beyond the link-following description as single-sourced until Microsoft's advisory is reviewed directly.

## 4\. Mitigation & containment

### P1 — within 24 hours

- Inventory and enumerate all Windows 11 and Windows Server 2025 hosts, including Server Core installations and virtualisation hosts, in the estate. Server Core is frequently missed by workstation-centric patch reporting.
- Apply the September 2026 Windows security updates to those platforms immediately; this is the vendor fix. Do not defer to the standard monthly cycle — the flaw is KEV-listed with active exploitation and a CISA due date of 2026-09-22.
- Hunt for prior exploitation on Windows 11 / Server 2025 hosts: review Update Stack service activity, unexpected SYSTEM-privileged file modifications in update staging paths, and any anomalous link/junction creation by standard user accounts. EDR telemetry on `MoUsoCoreWorker`/`TiWorker`\-adjacent file operations is the right starting lens, though the sources do not name the exact abused component.
- Deploy the September 2026 updates for CVE-2026-85880 (Windows ALPC) in the same push — Microsoft assesses it exploited in the wild, and it covers the Windows 10 / Server 2012–2022 population this CVE does not.

### P2 — within 72 hours

- Verify patch compliance against the CISA KEV due date of 2026-09-22 and report exceptions to asset owners; escalate any host that cannot be patched (legacy appliance, validated system) for compensating controls.
- For unpatchable Windows 11 / Server 2025 systems: restrict interactive local logon for standard users, enforce least-privilege on service accounts, and increase EDR monitoring sensitivity on those hosts. Note there is no vendor mitigation short of patching described in the source material.
- Review multi-user systems — terminal servers, jump hosts, Citrix/RDS farms — as the highest-value targets for a local privilege-escalation primitive; these should be patched first if sequencing is forced.

### P3 — within 7 days

- Fold the full September 2026 Patch Tuesday (973 fixes, 113 critical) into the standard cycle, prioritising the two exploited-in-the-wild items (CVE-2026-81963, CVE-2026-85880) and the critical RCEs in Skype for Business Server (CVE-2026-66302, CVSS 9.8, unauthenticated arbitrary file write) and Windows Message Queuing (CVE-2026-69579, CVSS 9.8) on internet-exposed or internally reachable deployments.
- Update vulnerability-management policy so CISA KEV additions trigger an accelerated (≤14-day) patch SLA with documented exceptions, and record this cycle as evidence under DORA Art. 24 resilience testing.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The sources describe no hashes, domains, IPs, file artefacts or behavioural patterns associated with the in-the-wild exploitation of CVE-2026-81963.

## 6\. Detection

Insufficient indicators to author detection rules. The source material contains no exploit artefacts — no malicious strings, file paths, registry keys, command lines or mutex names — only vulnerability description text. A rule built from the CVE identifier or product names would detect reporting about the threat, not the threat itself.

## CVE assessment

1 referenced CVE — **1 actively exploited (CISA KEV)**

| CVE                                                                              | CVSS     | Exploited        | EPSS | Summary                                                                                                                          |
| -------------------------------------------------------------------------------- | -------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- |
| [CVE-2026-81963](https://nvd.nist.gov/vuln/detail/CVE-2026-81963?ref=f4n6.co.uk) | 7.8 High | ⚠ KEV 2026-09-08 | —    | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate… |

## 7\. Sources

- NVD — CVE-2026-81963 — Microsoft Windows: Microsoft Windows Link Following Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-81963 — 2026-09-07
- CISA Known Exploited Vulnerabilities — CVE-2026-81963 entry (via NVD) — https://nvd.nist.gov/vuln/detail/CVE-2026-81963 — KEV added 2026-09-08, due 2026-09-22
- SANS Internet Storm Center — September 2026 Microsoft Patch Tuesday — https://isc.sans.edu/diary/rss/33320 — 2026-09-08
- NVD — CVE-2026-85880 — Microsoft Windows: Microsoft Windows Heap-Based Buffer Overflow Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-85880 (context)
- NVD — CVE-2026-68820 — Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free — https://nvd.nist.gov/vuln/detail/CVE-2026-68820 (context)
- NVD — CVE-2026-41091 — Microsoft Defender Link Following Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-41091 (context)
- ANSSI CERT-FR — CERTFR-2026-AVI-1001 — Multiples vulnérabilités dans Microsoft Windows — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1001/ (context)
- ANSSI CERT-FR — CERTFR-2026-AVI-0869 — Multiples vulnérabilités dans Microsoft Windows — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0869/ (context)

## 8\. Adverse Trace position

CVE-2026-81963 is a HIGH-severity (CVSS 7.8), actively exploited, CISA-KEV-listed local privilege-escalation vulnerability in the Windows Update Stack on Windows 11 and Windows Server 2025 — the platforms most EMEA financial institutions are standardising on. Its risk is not as an entry point but as a force multiplier: any low-privilege foothold on an unpatched host becomes SYSTEM, which in turn unlocks credential theft, defence evasion and lateral movement across the domain. The absence of public disclosure before Patch Tuesday means detection engineering has no PoC to build from, so patch velocity is the only reliable control; clients should treat the 2026-09-22 KEV due date as a ceiling, not a target, and complete Windows 11 / Server 2025 coverage — including Server Core — within days. Attribution of the in-the-wild exploitation is unconfirmed and no IOCs are published; we are monitoring Microsoft's advisory, CISA and vendor telemetry for exploit artefacts and will issue a follow-up note with detection content if indicators emerge. We assess the practical client impact as high for any organisation with delayed patch cycles on current Windows platforms, and moderate where KEV-driven accelerated patching is already embedded in operational process.

---

[Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-81963?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*