CVE-2026-81963Privilege escalation in Windows Update Stack
Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.
View on NVDAnalysis
Una vulnerabilidad en el componente Windows Update Stack permite que un atacante con acceso local eleve sus privilegios hasta el nivel de SYSTEM mediante el seguimiento de enlaces simbólicos. Este fallo está siendo explotado activamente para comprometer estaciones de trabajo y servidores Windows modernos. Se recomienda actualizar de inmediato para mitigar el riesgo de compromiso total del sistema.
Relevant roles
Severity
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCWE-59CWE-284CISA KEV
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
EPSS
No EPSS score yet (CVE may be too fresh).
Affects
microsoft:windows_11_23h2microsoft:windows_11_24h2microsoft:windows_11_25h2microsoft:windows_11_26h1microsoft:windows_server_2025Technical description
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.