Zero Day · Security
2026-09-08CriticalSecurity
CVE-2026-81963 · Windows Update Stack Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
What changed
Elevation of Privilege 12437 · CVSS 7.8. 1.2 · Updated an acknowledgement. This is an informational change only.
Technical details
- Install the applicable Microsoft security update listed in the MSRC record.
Why it matters
Microsoft marks exploitation as detected, so affected systems require immediate remediation and validation.
Known limitations
- Exploited: Yes · Publicly disclosed: No
- Affected products and fixed builds remain authoritative in the linked Microsoft record.
Now check
- Identify affected products and versions in the MSRC record
- Deploy the applicable security update through the normal pilot and production rings
- Verify the fixed build and review exploitation guidance after deployment