Microsoft Windows Update Stack Link-Following Privilege Escalation

Windows Update Stack contains an improper link resolution vulnerability (link following) that allows a local attacker to escalate privileges to SYSTEM level.

Link following, classified under CWE-59, occurs when a privileged process follows a symbolic link or junction point without first confirming that the target path is one it should act on. The Windows Update Stack runs with elevated privileges to manage patch staging and installation. If an attacker places a controlled symlink at a path the stack normally writes to, that write gets redirected to an arbitrary target, overwriting system files or registry entries that control execution. With write access to privileged system objects, the attacker can reach SYSTEM-level access.

The Windows Update Stack is the component responsible for staging, validating, and applying updates through Windows Update. It runs as a trusted service with access to protected directories and does not require any elevated starting point from the attacking process. A user with only standard account access can trigger the flaw; no administrator rights or unusual system configuration are needed.

Patched September 8, 2026 as part of Microsoft’s record September Patch Tuesday, which addressed 974 CVEs total. CISA added CVE-2026-81963 to its Known Exploited Vulnerabilities catalog the same day. Federal agencies must apply mitigations by September 22, 2026 per BOD 26-04.

CVE-2026-81963 and CVE-2026-85880, a Windows ALPC heap buffer overflow with the same CVSS 7.8 severity rating, were both patched on September 8 and added to CISA KEV in the same update batch. Both are local privilege escalation flaws with no direct remote exploitation path. CISA’s active-exploitation confirmation on both means they are used in real intrusions, typically as the privilege escalation step after an initial foothold has been established by other means. A chain pairing remote code execution with either LPE gives an attacker a path from initial access to full system control.

This flaw is not directly remotely exploitable on its own. Local access on the target machine is a required starting condition. Apply the September 8, 2026 cumulative Windows update to close the vector. Microsoft’s update documentation lists the specific KB article for each supported Windows release.

CISA added two other vulnerabilities in the same September 8 KEV batch that warrant parallel urgency: CVE-2026-75650, a CVSS 10.0 template-engine injection in Adobe Commerce under active exploitation, and CVE-2026-86218, a CVSS 10.0 pre-authentication RCE in N-able N-central.

For full Patch Tuesday context, see Microsoft Patches Record 974 Vulns, 2 Zero-Days.