CVE-2026-81963
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Sep 8, 2026
- US federal agencies must remediate it by Sep 22, 2026 (BOD 22-01)
- Attacked 1 day before the vulnerability was made public
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Sep 8, 2026 Sep 8, 2026 Sep 8, 2026 Sep 8, 2026
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| microsoft | windows 11 23h2 | < 10.0.22631.7582 |
| microsoft | windows 11 24h2 | < 10.0.26100.9445 |
| microsoft | windows 11 25h2 | < 10.0.26200.9445 |
| microsoft | windows 11 26h1 | < 10.0.28000.2954 |
| microsoft | windows server 2025 | < 10.0.26100.33438 |
Related articles
FortiMail and NetScaler Exploitation Drives an Urgent Enterprise Patch Cycle
FortiMail path traversal and NetScaler SAML flaw under active exploit join CISA KEV, forcing urgent patching plus PHP, PaperCut and Spectre fixes.
Warlock Uses On-Premises SharePoint to Deploy Ransomware on at Least 33 Hosts
China-linked Warlock ransomware exploited on-premises SharePoint flaws to breach utilities and governments, deploying ransomware on 33+ hosts via SYSVOL.
NetScaler Intrusions Turn a Gateway Flaw Into Root-Level Network Access
Mandiant links CVE-2026-88772 to NetScaler attacks granting root access, web shells, and internal network tunnels across dozens of orgs.
SharePoint Code-Injection Flaw Opens a Low-Privilege Route to Remote Server Control
CVE-2026-65660 lets low-privilege users run code on SharePoint Server via SafeControls bypass. Learn impact, affected versions and patch steps.
Microsoft’s 974-Fix Security Release Forces a Triage Test for Windows Defenders
Microsoft patched 974 flaws in September, including two exploited privilege-escalation bugs and two 9.8-rated RCEs requiring urgent triage.
BragJack Turns Browser Extensions Into Control Channels for AI Agents
BragJack shows how a malicious Chrome extension can hijack Gemini, Comet, Edge, Opera and Claude AI agents to steal files and take actions.
Azure AI Foundry Authentication Failure Earns Maximum-Severity CVSS Rating
Microsoft mitigated CVE-2026-85889, a CVSS 10.0 auth flaw in Azure AI Foundry allowing remote privilege escalation, plus Copilot and Azure bugs.
NightEagle, Hacking Cat, and Toy Ghouls Target Russian Networks
Kaspersky reports NightEagle, Hacking Cat and Toy Ghouls targeting Russian firms with Exchange exploits, backdoors, ransomware and wipers.
China-Linked Hackers Chain Chrome and Windows Zero-Days to Breach NGOs
China-linked UTA0560 and APT31 chained Chrome and Windows zero-days via spear-phishing to breach NGOs, deploying GRIMWEDGE and credential-stealing malware.
AI-Orchestrated PaperCut Campaign Compromises 395 Organizations Worldwide
AI agents exploited PaperCut flaws to compromise 395 organizations in 48 countries, escalating from RCE to domain admin in minutes.
ShieldCrash PoC Claims to Bypass Microsoft’s Fix for Defender Privilege Flaw
ShieldCrash PoC claims bypass of Microsoft's fix for CVE-2026-69414, enabling SYSTEM-level file reads on patched Windows via Defender.
Fortinet CVE-2025-25249 Exploited at Scale to Install PivotC2 RAT
Attackers exploit Fortinet CVE-2025-25249 RCE flaw at scale, scanning 30,000+ IPs to install PivotC2 RAT on 178 devices for tunneling and data theft.
BlueMoon Exploit Kit Gives Four Espionage Groups a Shared Chrome-to-Windows Attack Chain
Four espionage groups use BlueMoon exploit kit chaining Chrome V8 flaws and Windows ALPC bug to escape sandbox and deploy payloads.
Microsoft Defender ShieldCrash PoC Claims to Bypass the ShieldBreak Fix
New ShieldCrash PoC allegedly bypasses Microsoft's ShieldBreak fix (CVE-2026-69414), enabling SYSTEM file read via Defender engine.
Actively Exploited N-able N-central Flaw Enables Pre-Authentication Remote Code Execution
CISA warns CVE-2026-86218 in N-able N-central is actively exploited, enabling pre-auth RCE. Update to 2026.3 Hotfix 4 immediately.
Microsoft Patches 966 Flaws as Two Windows Zero-Days Come Under Active Attack
Microsoft fixed 966 flaws in record September Patch Tuesday, including two exploited Windows privilege-escalation zero-days leading to SYSTEM access.
This product uses the NVD API but is not endorsed or certified by the NVD.