CVE-2026-81963: The September 2026 Windows Update Stack Vulnerability Already Being Exploited

What is CVE-2026-81963

CVE-2026-81963 is a flaw in the Windows Update Stack — the component responsible for downloading, verifying, and applying Windows updates on the device. The weakness is a link-following vulnerability (formally classified as CWE-59: Improper Link Resolution Before File Access).

In a link-following attack, an attacker with a low-privilege local account manipulates how the Windows Update Stack resolves file paths during an update operation. By placing a symbolic link at precisely the right location before the Update Stack accesses a file, the attacker redirects a file write operation from the Update Stack into a location that only SYSTEM should be able to modify. The result is privilege escalation from a standard user account to SYSTEM — the highest privilege level on a Windows device, above even a local administrator.

The vulnerability requires no interaction from another user on the machine, and no unusual configuration. It works on a standard domain-joined or Entra-joined corporate workstation running an affected build of Windows 11.

Which devices are affected

The vulnerability affects Windows 11 and Windows Server 2025. Windows 10 and Windows Server 2019 and 2022 are not listed as affected by this specific CVE. The fix ships in the September 2026 cumulative update for each affected version.

All five updates were released on 8 September 2026 as part of the September Patch Tuesday cycle. The fix is included in the full cumulative update for each version — there is no separate security-only package that patches CVE-2026-81963 in isolation.

How to check your exposure

The fastest way to confirm whether a device has received the fix is to check its current OS build number. Each fixed version has a specific build number listed in the table above. Run the following from an elevated or standard PowerShell session:

You can also verify directly by checking whether the cumulative update KB is recorded as installed. For Windows 11 24H2 and 25H2 devices, which share the KB5124008 package:

For fleet-wide visibility across Intune-managed devices, filter on OS build version in the Intune device list or use a PowerShell remediation script to report compliance state across your estate.

Deployment guidance

The confirmed exploitation of CVE-2026-81963 means this update cannot simply be deferred. At the same time, there are separate community-reported issues with KB5124008 in environments with on-premises Active Directory domain controllers running Windows Server 2019 or some configurations of Server 2022. The right deployment approach depends on how your devices are joined.

Entra ID-joined devices with no on-premises Active Directory dependency — expedited phased rollout:

For modern Windows 11 devices managed entirely through Microsoft Entra ID and Microsoft Intune — with no on-premises domain controller in the authentication path — the correct approach is to continue deploying the September update, but in controlled stages rather than all at once.

Windows 11 25H2 devices joined to on-premises Active Directory — additional caution required:

The framing for management conversations: “This September update fixes a vulnerability already being exploited by attackers to take full control of Windows devices. We are deploying it, but in controlled pilot groups. Devices that use traditional on-premises Active Directory authentication need additional validation before we push the update widely.”

References

• CVE-2026-81963 — Security Update Guide (Microsoft Security Response Centre)
• Windows 11 25H2 release health — known issues dashboard (Microsoft Learn)
• KB5124008 in the Microsoft Update Catalog

All CVE details sourced from the Microsoft Security Response Centre. Last reviewed: 11 September 2026.