CVE-2026-81963Vulnerability

Microsoft Windows Link Following Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on 8 Sep 2026.

Reported by 12 independent sources · first reported 8 Sep 2026 by Tenable · last reported 13 Oct 2026

Last reported 12 days ago

CISA KEVAdded 8 Sep 2026
Fix due 22 Sep 2026
Used by ransomware: not knownCISA KEV catalogue

EPSS0.4%
higher than 32% of CVEsFIRST EPSS, as of 23 Oct 2026

What the reports say

12 reports, newest first · the exact sentence from each

“CVE-2026-81963”

Recorded FutureVendor13 Oct 2026
September 2026 CVE Landscape
“Despite this massive number, only two, CVE-2026-85880 and CVE-2026-81963, were reported Known Exploited and none were Publicly Disclosed.”

Help Net SecurityNews9 Oct 2026
October 2026 Patch Tuesday forecast: Time for an Office cleanup
“…-94545 (Next.js), CVE-2026-73857, CVE-2026-73856 (ModSecurity), CVE-2026-12855 (InsydeH2O IHISI SMM), MTLVULN-1694 (Mitel MiCollab), CVE-2026-81963 (Microsoft Windows), CVE-2026-90970, CVE-2026-1868 (GitLab AI Gateway), CVE-2026-79898, CVE-2026-12627, CVE-2026-79901 (Fortra BoKS)…”

The Hacker NewsNews5 Oct 2026
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
“CVE-2026-81963 -- Windows Update Stack Elevation of Privilege Vulnerability”

Sophos X-OpsVendor16 Sep 2026
September Patch Tuesday haul includes 973 CVEs
“CVE-2026-85880 and CVE-2026-81963 both allow local attackers to elevate privileges to SYSTEM, while 20 additional flaws could enable unauthenticated remote code execution without user interaction.”

Check Point ResearchVendor14 Sep 2026
14th September – Threat Intelligence Report
“The other flaw, CVE-2026-81963, is an improper link resolution before file access in Windows Update Stack, which allows an authorized attacker to elevate privileges locally.”

Infosecurity MagazineNews9 Sep 2026
Microsoft Shatters Patch Tuesday Record With 974 CVE Fixes in September 2026
“CVE-2026-81963 - Windows Update Stack Elevation of Privilege Vulnerability”

Risky Business NewsNews9 Sep 2026
Risky Bulletin: Ukraine's top prosecutor resigns amid scam call center scandal
“CVE-2026-81963”

JPCERT/CC alertsGovernment9 Sep 2026
Security Alert: Microsoft Releases September 2026 Security Updates
“CVE-2026-81963 affects Windows Update Stack.”

Cisco TalosVendor8 Sep 2026
Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
“There are two “zero-day” flaws fixed this month that are being actively exploited: both CVE-2026-81963 and CVE-2026-85880 allow an attacker to elevate their privileges on Windows system.”

Krebs on SecurityNews8 Sep 2026
Microsoft Plugs Nearly 1,000 Security Holes
“CVE-2026-81963: Windows Update Stack Elevation of Privilege Vulnerability”

Qualys Threat ResearchVendor8 Sep 2026
Microsoft and Adobe Patch Tuesday, September 2026 Security Update Review
“Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)”

TenableVendor8 Sep 2026
Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Indicators reported together

named in the same reports

idscan[.]netin 1 report

Copy this indicator · defanged

1 indicator, defanged, one per line

idscan[.]net

Also named with it: CVE-2026-85880, CVE-2026-69730, CVE-2026-85046, CVE-2026-69829, CVE-2026-81578, CVE-2026-82078, CVE-2026-86060, CVE-2026-69676, CVE-2026-69525, CVE-2026-85706, CVE-2026-67276, CVE-2026-86218, CVE-2026-75650, CVE-2026-86950, CVE-2026-76504, CVE-2026-60004, CVE-2026-58231, CVE-2022-0847, CVE-2026-35273

Thanks — we review every report.

Report a wrong value