CVE-2026-81963: Microsoft Windows Link Following Flaw Added to CISA KEV

TL;DR

CISA added CVE-2026-81963, a link following vulnerability in the Microsoft Windows Update Stack, to the Known Exploited Vulnerability (KEV) catalog on 2026-09-08. Federal civilian agencies must remediate by 2026-09-22, and all defenders should treat Windows endpoints as priority patch targets this cycle. Apply Microsoft's update guidance, confirm the Update Stack components are patched, and document closure per BOD 26-04.

What this is

CVE-2026-81963 is a link following vulnerability in the Microsoft Windows Update Stack, tracked as CWE-59 (Improper Link Resolution Before File Access / 'Link Following') and CWE-284 (Improper Access Control). Microsoft rates it 7.8 HIGH with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. A local, authorized attacker can escalate privileges up to SYSTEM. CISA added it to the KEV catalog on 2026-09-08, with a due date of 2026-09-22. Known ransomware use is listed as Unknown at time of cataloging.

Why it matters

In plain terms, the Windows Update Stack can be tricked into following a link it should not resolve, letting a low-privileged local user reach SYSTEM. Because the attack requires local access, the practical risk is post-compromise escalation: an attacker who already has a foothold on a host can use this to gain full control of that endpoint. KEV status means exploitation has been observed in the wild, so this is not a theoretical severity exercise. A low EPSS score does not downgrade a KEV entry. KEV reflects observed exploitation; EPSS reflects modeled likelihood. When they disagree, KEV wins for patch scheduling.

How it works

The flaw is a link following issue in the Windows Update Stack, classified under CWE-59 and CWE-284. The CVSS vector is AV:L (local), so exploitation requires local access to the target host. That does not eliminate risk — it means the flaw is most dangerous as a privilege-escalation step after an initial foothold. The impact is escalation up to SYSTEM for a local, authorized attacker. Microsoft's severity rating is 7.8 HIGH. The EPSS score is 0.00631, at the ~48.6th percentile, a low modeled likelihood that KEV status overrides for prioritization.

Detection and response

The hypothesis to test is whether any Windows endpoint or server in scope still runs an unpatched Windows Update Stack build. The evidence that confirms or rejects it is the installed build level of the affected Update Stack components, compared against Microsoft's update guide for CVE-2026-81963, plus a re-scan after patching to validate the result.

Signal	What it measures	How to use it for this CVE
CISA KEV	Confirmed in-the-wild exploitation	Authoritative trigger. Treat as exploited; remediate by 2026-09-22.
CVSS	Theoretical severity of the flaw	7.8 HIGH with local attack vector (AV:L). Prioritize hosts where local access is plausible (VDI, RDS, shared endpoints).
EPSS	Probability of exploitation in the next 30 days	0.00631 (percentile ~0.486). Low predictive score, but KEV status overrides EPSS for prioritization.

What to do

1. Inventory. Enumerate Windows endpoints and servers, and identify which build levels include the Windows Update Stack. Include VDI, RDS, and any host where non-admin users can run code.
2. Patch. Apply Microsoft's update for CVE-2026-81963 per the MSRC update guide. Follow CISA BOD 26-04 guidance for prioritizing security updates based on risk.
3. Mitigate where patching is delayed. If a host cannot be patched immediately, apply vendor-provided mitigations or isolate the asset. For cloud services, follow BOD 26-04 guidance or discontinue use of the affected product if mitigations are unavailable.
4. Verify. Confirm the update is installed and the affected Update Stack components reflect the patched build. Re-scan to validate.
5. Assess exposure. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Even for a local-vector flaw, exposure context drives scheduling.
6. Ticket closure. Record patch evidence, verification output, and any compensating controls. Retain artifacts consistent with CISA's Forensics Triage Requirements under BOD 26-04.

FAQ

Is CVE-2026-81963 in CISA KEV? Yes. CISA added it to the Known Exploited Vulnerability catalog on 2026-09-08.

What is the CISA due date? 2026-09-22. Federal civilian agencies must remediate by that date; other organizations should align to it as a practical deadline.

Is this vulnerability internet-facing? The CVSS vector is AV:L (local), so exploitation requires local access to the target host. That does not eliminate risk — it means the flaw is most dangerous as a privilege-escalation step after an initial foothold. Evaluate each asset's exposure per BOD 26-04.

Is there a ransomware tie? Known ransomware use is listed as Unknown in the source intel. Treat KEV status as sufficient reason to prioritize regardless.

What is the CVSS score and severity? 7.8, HIGH, per Microsoft (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

What is the EPSS score? 0.00631, at the ~48.6th percentile. Low modeled likelihood, but KEV status takes precedence for scheduling.

Sources

• Microsoft MSRC update guide for CVE-2026-81963
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance: Forensics Triage Requirements
• NVD entry for CVE-2026-81963