CVE-2026-81963

Microsoft Windows

score 80Known exploited · added 2026-09-08watchlist: microsoft

Summary

Microsoft Windows Link Following Vulnerability

Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.

Published 2026-09-08 · first seen here 2026-10-10

CISA required action (due 2026-09-22): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Analysis & write-ups

No technical write-up from a research team yet. Contact Zero checks Unit 42, Google/Mandiant, Microsoft, Talos, CrowdStrike, Rapid7, watchTowr and others several times a day, plus NVD and CISA reference links.

Where it shows in your logs

Windows or Active Directory · Path traversal (read or write arbitrary files) high confidence

What to look for

Requests containing ../, ..%2f, %2e%2e%2f, ..\ or double-encoded variants
Successful (200) responses to requests for config files, keys or password stores (web.config, /etc/passwd, .env)
If file write is possible: new files in startup, cron or web folders
Processes running as SYSTEM whose parent is a normal user process
New local or domain admin accounts, or users added to privileged groups
Unusual logons (type 3 or 10) to servers right before suspicious processes start

Data sources

Process creation · ATT&CK DS0009 Process Creation

Sentinel: DeviceProcessEventsSecurityEvent (4688)Sysmon Event ID 1_Im_ProcessCreate
Splunk: Endpoint.ProcessesXmlWinEventLog:Microsoft-Windows-Sysmon/OperationalWinEventLog:Security (4688)
CrowdStrike: ProcessRollup2SyntheticProcessRollup2

Authentication and sessions · ATT&CK DS0028 Logon Session Creation / DS0002 User Account Authentication

Sentinel: SigninLogsSecurityEvent (4624, 4625, 4648)DeviceLogonEventsIdentityLogonEvents_Im_Authentication
Splunk: Authentication.Authenticationpan:globalprotectVPN sourcetypes
CrowdStrike: UserLogonUserLogonFailed2Falcon Identity Protection events

Account and group changes · ATT&CK DS0002 User Account Creation / Modification

Sentinel: SecurityEvent (4720, 4728, 4732, 4756)AuditLogsIdentityDirectoryEvents
Splunk: Change.All_Changes (Account_Management)WinEventLog:Security (4720, 4732)
CrowdStrike: UserAccountCreatedUserAccountAddedToGroup

Web server and WAF logs · ATT&CK DS0015 Application Log Content

Sentinel: W3CIISLogAppServiceHTTPLogsAzureDiagnostics (Application Gateway / Front Door WAF)_Im_WebSession
Splunk: Web.Webms:iis:autoaccess_combinedWAF / proxy sourcetypes
CrowdStrike: Falcon Next-Gen SIEM: third-party web / WAF / proxy logs

A generic baseline worked out from the product type and weakness (CWE-284, CWE-59), not a detection. Check table and field names against your environment. Hunt queries for Sigma, Splunk, Sentinel and CrowdStrike are coming.

News & advisories

CVE-2026-81963 Windows Update Stack Elevation of Privilege Vulnerability · Microsoft MSRC
14th September – Threat Intelligence Report · Check Point Research