CISA KEV: Windows Update Stack Link-Following Flaw (CVE-2026-81963) Actively Exploited for SYSTEM Privilege Escalation

What happened

Microsoft disclosed a link-following vulnerability in the Windows Update Stack, tracked as CVE-2026-81963, and it has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog as of 2026-09-08. Per Microsoft's advisory, the flaw allows a local attacker to escalate privileges to SYSTEM by abusing how the Update Stack follows file system links. A CVSS score has not been published yet, and CISA's KEV entry indicates active exploitation, though details on the specific threat actors or campaigns involved have not been disclosed. Ransomware use is currently listed as unknown.

Why it matters

This is a local privilege escalation (LPE) affecting Windows, not a remote code execution bug — but LPE flaws in core OS components like the Update Stack are highly valuable to attackers who already have a foothold (via phishing, a web shell, or a compromised low-privileged account) and need to pivot to SYSTEM for full control, credential harvesting, or persistence. Its inclusion in CISA KEV means it's being used in the wild now, which triggers mandatory remediation timelines for U.S. federal agencies and should elevate priority for any organization running Windows endpoints or servers.

What defenders should do now

• Check Microsoft's advisory for affected Windows versions and apply the update as soon as it's validated in your environment; KEV status means patching should be expedited, not deferred to a normal cycle.
• Hunt for anomalous SYSTEM-level process creation or token manipulation following the Windows Update service (wuauserv/Update Orchestrator) activity, especially where the initiating user context was non-administrative.
• Watch for suspicious symbolic link, junction, or reparse point creation in directories touched by the Update Stack, which is the general mechanism behind link-following LPE bugs.
• Review EDR/AV telemetry for unexpected child processes spawned by Windows Update components immediately before a privilege change to SYSTEM.
• Ensure endpoint logging (Sysmon, Windows Security auditing for privilege use and object access) is enabled broadly enough to reconstruct a local escalation chain if this technique is used post-compromise.

Developing intel

Details remain limited at this stage — no CVSS score, exploit code, or attribution have been published, and this write-up will be updated as more information becomes available. This is not tied to a specific df00tech detection rule at this time. For the authoritative advisory, see Microsoft's MSRC entry: CVE-2026-81963.