Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory

1. Apply Official Security Patches

The primary and recommended mitigation is to apply the latest cumulative security updates provided by Microsoft.

• Via Windows Update GUI:

Navigate to Settings > Update & Security > Windows Update and install all pending security updates.

• Via PowerShell (Administrator):

  Install-Module PSWindowsUpdate
  Get-WindowsUpdate -AcceptAll -Install -AutoReboot

2. Temporary Mitigations (If patching is delayed)

• Restrict Symbolic Link Creation:

Ensure that the Create symbolic links user right (under Local Security Policy > User Rights Assignment) is restricted to trusted administrators only.

• Audit Directory Permissions:

Tighten Access Control Lists (ACLs) on temporary directories to prevent non-admin users from creating junctions or symbolic links pointing to system directories.

• EDR Detection Rules:

Configure Endpoint Detection and Response (EDR) tools to monitor and block suspicious symbolic link creation by non-privileged processes.

Technical Analysis & Root Cause

This vulnerability (CVE-2026-81963) is a Link Following vulnerability (CWE-59) combined with Improper Access Control (CWE-284) within the Windows Update Stack.

The Windows Update Stack operates with elevated privileges (NT AUTHORITY\SYSTEM) to perform system maintenance and updates. During file operations, the update process fails to properly validate whether a target file path is a symbolic link or junction point. A local attacker with low privileges can exploit this behavior by creating a symbolic link in a writable directory that points to a protected system file.

Exploit Mechanics

• Local Access: The attacker gains local execution capabilities on the target Windows machine with standard user privileges.
• Symlink Creation: The attacker creates a symbolic link or junction point in a temporary directory (e.g., under C:\Windows\Temp) pointing to a critical system file (e.g., in C:\Windows\System32).
• Triggering the Update: When the Windows Update service runs, it accesses the path without verifying the link, performing file operations on the target system file with SYSTEM privileges.
• Privilege Escalation: This allows the attacker to overwrite critical system binaries or hijack DLLs, resulting in arbitrary code execution as SYSTEM.

Real-World Impact

With a CVSS score of 7.8 (High) and an EPSS score of 0.94, this vulnerability is highly exploitable. It is listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation in the wild. Immediate remediation is critical to prevent local privilege escalation (LPE) attacks.