Windows Update Stack CVE-2026-81963: Federal KEV Due Today (September 22)

CISA added the Update Stack elevation-of-privilege zero-day to KEV on September 8, and today is the federal due date. If September’s cumulative update hasn’t been verified on your Windows 11 and Server 2025 fleets, finish that check today.

CVE-2026-81963: a link-following bug that hands a local user SYSTEM

CVE-2026-81963 is a link-following / improper access control bug in the Windows Update Stack. A local attacker with low privileges abuses how the stack resolves links and escalates to SYSTEM. No user interaction required. Microsoft shipped the fix in the September 2026 cumulatives; CISA added it to KEV on September 8 with a BOD 26-04 due date of September 22, 2026. Forensic triage is required.

Affected trains include Windows 11 23H2 / 24H2 / 25H2 / 26H1 and Windows Server 2025 (including Server Core). Example fixed builds cited in public guidance: 22631.7582, 26100.9445, 26200.9445, 28000.2954, and Server 2025 26100.33438 (verify against Microsoft’s update guide for your SKU).

Note: the sibling ALPC zero-day (CVE-2026-85880) shares the same KEV due date. If you patched ALPC last week but skipped Update Stack coverage on some rings, finish the pair today.

Exploited, on nearly every endpoint, and due today

Attackers who land with a low-privilege foothold usually need a local EoP next. The Update Stack runs elevated during patch operations and is on essentially every supported endpoint, so an attacker who controls that path can interfere with the patching meant to remove them. CVSS 7.8 looks modest next to 9.8 RCEs. The Exploitation Detected status is why it made KEV and why today’s deadline matters.

Confirm the September cumulative is running, then triage

• Verify September 2026 cumulatives that remediate CVE-2026-81963 are installed and running. Approval in WSUS/Intune is not enough.
• Prioritize endpoints that already showed suspicious local code execution, browser exploit indicators, or BlueMoon-adjacent process trees.
• Close the ALPC sibling (CVE-2026-85880) on any ring still open. It has the same due date.
• After patch: forensic triage on hosts that were internet-exposed or showed pre-patch privilege-escalation symptoms.

Details

• CVE: CVE-2026-81963 (CVSS 7.8, CWE-59 / CWE-284)
• Impact: Elevation of Privilege → SYSTEM
• KEV: Added 2026-09-08; federal due 2026-09-22; forensic triage Yes
• Ransomware use (CISA): Unknown
• Sibling due same day: CVE-2026-85880 (Windows ALPC heap overflow)

Hunt / verify

• Inventory build numbers against the fixed builds for each train.
• Hunt SYSTEM processes spawned from standard-user sessions, especially activity touching update directories outside maintenance windows.
• Confirm Server Core and VDI golden images received the cumulative. A stale golden image keeps putting unpatched machines into a fleet that reports as patched.

Sources

• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog
• https://nvd.nist.gov/vuln/detail/CVE-2026-81963

Related: see every Microsoft vulnerability CISA added to its exploited list in 2026, with the fix for each and links to our coverage.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].