Actively exploited in the wild
Microsoft Windows Link Following Vulnerability
Microsoft - Windows · Listed in the CISA KEV since 2026-09-08. This indicates confirmed attacks in production environments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-81963
HighCVSS 7.8KEVSummary
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
Risk Assessment
An attacker could exploit symbolic links to overwrite critical system files, potentially leading to privilege escalation and system compromise.
Recommendation
Apply the Windows security updates provided by the vendor.
Other vulnerabilities in Windows Update Stack
See all- CVE-2021-26889High
Elevation of privilege vulnerability in Windows Update Stack. Allows an attacker to gain elevated privileges.
- CVE-2021-1729High
Elevation of privilege vulnerability in Windows Update Stack Setup. An attacker could exploit it to gain elevated privileges on the system.
- CVE-2020-1110High
An elevation of privilege vulnerability in Windows Update Stack due to improper handling of objects in memory. An attacker could run arbitrary code in kernel mode, install programs, view, change or delete data, or create new accounts with full user rights.
- CVE-2020-1109High
Elevation of privilege vulnerability in Windows Update Stack. An attacker who logs on can run a specially crafted application to execute code in kernel mode, allowing installation of programs, data modification, or creation of accounts with full user rights.
Original NVD description (English source)
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.