{"id":"CVE-2026-81963","published":"2026-09-08T18:21:00Z","modified":"2026-09-09T05:18:17Z","title":"Microsoft Windows Link Following Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.","provenance":"source","from":"NVD"},"summary":{"text":"The vulnerability is an improper link resolution before file access (\"link following\") flaw in the Windows Update Stack component of Microsoft Windows. An authorized attacker with local access and low privileges can exploit it, without user interaction, to elevate their privileges on the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T22:21:57Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00393,"percentile":0.33546,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2026-09-08","dueDate":"2026-09-22","ransomware":false,"requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-81963","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-09-08","exploitedFirstSeen":"2026-09-08","ransomware":false,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Sep","date":"2026-09-08"},{"url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-73889","date":"2026-09-08"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963","date":"2026-09-08"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-09-08"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-59","name":"Improper Link Resolution Before File Access"},{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: local privilege escalation via link following","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows an authorized attacker to elevate privileges locally","start":87,"end":146}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: link following enables file-based code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Improper link resolution before file access ('link following')","start":0,"end":62}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-73889","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-73889","exploited":true,"exploitedSince":"2026-09-08","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-10-19","earliestUrl":"https://github.com/rsah35404-star/stunning-octo-doodle","repos":[{"name":"rsah35404-star/stunning-octo-doodle","url":"https://github.com/rsah35404-star/stunning-octo-doodle","stars":0,"created":"2026-10-19"}]},"first":{"date":"2026-10-19","source":"PoC-in-GitHub","url":"https://github.com/rsah35404-star/stunning-octo-doodle"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2026-09-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81963","provenance":"source"},{"date":"2026-09-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Sep","provenance":"source"},{"date":"2026-09-08","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-09-08","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-73889","provenance":"source"},{"date":"2026-10-19","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/rsah35404-star/stunning-octo-doodle","provenance":"source"}],"speed":{"daysToPublicExploit":41,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":62.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 54 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":6.71,"detail":"percentile 0.3355"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-59"}}