{"history":[{"alert":1,"cve":"CVE-2026-81963","id":23483,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.07115, \"percentile\": 0.94334}"},{"alert":0,"cve":"CVE-2026-81963","id":20952,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.00393, \"percentile\": 0.33853}"},{"alert":0,"cve":"CVE-2026-81963","id":18821,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.00393, \"percentile\": 0.33798}"},{"alert":0,"cve":"CVE-2026-81963","id":16887,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.00393, \"percentile\": 0.33781}"},{"alert":0,"cve":"CVE-2026-81963","id":14865,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.00393, \"percentile\": 0.33761}"},{"alert":0,"cve":"CVE-2026-81963","id":12646,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.00393, \"percentile\": 0.33715}"},{"alert":0,"cve":"CVE-2026-81963","id":10628,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.00393, \"percentile\": 0.33704}"},{"alert":0,"cve":"CVE-2026-81963","id":8175,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.00393, \"percentile\": 0.33695}"},{"alert":0,"cve":"CVE-2026-81963","id":5837,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.00393, \"percentile\": 0.33579}"},{"alert":0,"cve":"CVE-2026-81963","id":3652,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.00393, \"percentile\": 0.3353}"},{"alert":1,"cve":"CVE-2026-81963","id":1857,"kind":"cna","observed_at":1793665375,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-81963\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-09-07T00:00:00+00:00\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2026-09-08\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-09-09T04:25:46.635Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-09-08T00:00:00.000Z\", \"value\": \"CVE-2026-81963 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"platforms\": [\"ARM64-based Systems\"], \"product\": \"Windows 11 version 23H2\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"10.0.22631.7582\", \"status\": \"affected\", \"version\": \"10.0.22631.0\", \"versionType\": \"custom\"}]}, {\"platforms\": [\"x64-based Systems\"], \"product\": \"Windows 11 Version 23H2\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"10.0.22631.7582\", \"status\": \"affected\", \"version\": \"10.0.22631.0\", \"versionType\": \"custom\"}]}, {\"platforms\": [\"ARM64-based Systems\", \"x64-based Systems\"], \"product\": \"Windows 11 Version 24H2\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"10.0.26100.9445\", \"status\": \"affected\", \"version\": \"10.0.26100.0\", \"versionType\": \"custom\"}]}, {\"platforms\": [\"ARM64-based Systems\", \"x64-based Systems\"], \"product\": \"Windows 11 Version 25H2\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"10.0.26200.9445\", \"status\": \"affected\", \"version\": \"10.0.26200.0\", \"versionType\": \"custom\"}]}, {\"platforms\": [\"ARM64-based Systems\", \"x64-based Systems\"], \"product\": \"Windows 11 version 26H1\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"10.0.28000.2954\", \"status\": \"affected\", \"version\": \"10.0.28000.0\", \"versionType\": \"custom\"}]}, {\"platforms\": [\"x64-based Systems\"], \"product\": \"Windows Server 2025\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"10.0.26100.33438\", \"status\": \"affected\", \"version\": \"10.0.26100.0\", \"versionType\": \"custom\"}]}, {\"platforms\": [\"x64-based Systems\"], \"product\": \"Windows Server 2025 (Server Core installation)\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"10.0.26100.33438\", \"status\": \"affected\", \"version\": \"10.0.26100.0\", \"versionType\": \"custom\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"10.0.26100.33438\", \"versionStartIncluding\": \"10.0.26100.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*\", \"versionEndExcluding\": \"10.0.26200.9445\", \"versionStartIncluding\": \"10.0.26200.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*\", \"versionEndExcluding\": \"10.0.22631.7582\", \"versionStartIncluding\": \"10.0.22631.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*\", \"versionEndExcluding\": \"10.0.22631.7582\", \"versionStartIncluding\": \"10.0.22631.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*\", \"versionEndExcluding\": \"10.0.26100.9445\", \"versionStartIncluding\": \"10.0.26100.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"10.0.26100.33438\", \"versionStartIncluding\": \"10.0.26100.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*\", \"versionEndExcluding\": \"10.0.28000.2954\", \"versionStartIncluding\": \"10.0.28000.0\", \"vulnerable\": true}], \"negate\": false, \"operator\": \"OR\"}]}], \"datePublic\": \"2026-09-08T14:00:00.000Z\", \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.\"}], \"metrics\": [{\"cvssV3_1\": {\"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-59\", \"description\": \"CWE-59: Improper Link Resolution Before File Access ('Link Following')\", \"lang\": \"en-US\", \"type\": \"CWE\"}, {\"cweId\": \"CWE-284\", \"description\": \"CWE-284: Improper Access Control\", \"lang\": \"en-US\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-10-31T16:17:44.501Z\", \"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\"}, \"references\": [{\"name\": \"Windows Update Stack Elevation of Privilege Vulnerability\", \"tags\": [\"vendor-advisory\", \"patch\"], \"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963\"}], \"title\": \"Windows Update Stack Elevation of Privilege Vulnerability\"}}, \"cveMetadata\": {\"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"assignerShortName\": \"microsoft\", \"cveId\": \"CVE-2026-81963\", \"datePublished\": \"2026-09-08T17:19:13.121Z\", \"dateReserved\": \"2026-08-27T20:58:07.631Z\", \"dateUpdated\": \"2026-10-31T16:17:44.501Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":1,"cve":"CVE-2026-81963","id":69,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2026-81963\", \"cwes\": [\"CWE-59\", \"CWE-284\"], \"dateAdded\": \"2026-09-08\", \"dueDate\": \"2026-09-22\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-81963\", \"product\": \"Windows\", \"requiredAction\": \"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\\u2019s \\u201cForensics Triage Requirements\\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.\", \"shortDescription\": \"Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.\", \"vendorProject\": \"Microsoft\", \"vulnerabilityName\": \"Microsoft Windows Link Following Vulnerability\"}"}],"record":{"affected":[{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7582","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7582","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9445","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9445","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.2954","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33438","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33438","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-81963","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-07T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-09-08","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-09-09T04:25:46.635Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963"}],"timeline":[{"lang":"en","time":"2026-09-08T00:00:00.000Z","value":"CVE-2026-81963 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7582","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7582","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9445","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9445","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.2954","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33438","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33438","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26100.33438","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.26200.9445","versionStartIncluding":"10.0.26200.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.22631.7582","versionStartIncluding":"10.0.22631.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*","versionEndExcluding":"10.0.22631.7582","versionStartIncluding":"10.0.22631.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.26100.9445","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26100.33438","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*","versionEndExcluding":"10.0.28000.2954","versionStartIncluding":"10.0.28000.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"datePublic":"2026-09-08T14:00:00.000Z","descriptions":[{"lang":"en-US","value":"Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-59","description":"CWE-59: Improper Link Resolution Before File Access ('Link Following')","lang":"en-US","type":"CWE"},{"cweId":"CWE-284","description":"CWE-284: Improper Access Control","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-31T16:17:44.501Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":"Windows Update Stack Elevation of Privilege Vulnerability","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963"}],"title":"Windows Update Stack Elevation of Privilege Vulnerability"}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2026-81963","datePublished":"2026-09-08T17:19:13.121Z","dateReserved":"2026-08-27T20:58:07.631Z","dateUpdated":"2026-10-31T16:17:44.501Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794111601,"cve":"CVE-2026-81963","description":"Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.","epss":{"date":"2026-11-12","epss":0.07115,"percentile":0.94334},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2026-81963","cwes":["CWE-59","CWE-284"],"dateAdded":"2026-09-08","dueDate":"2026-09-22","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-81963","product":"Windows","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","shortDescription":"Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.","vendorProject":"Microsoft","vulnerabilityName":"Microsoft Windows Link Following Vulnerability"},"kev_checked":1794522003,"products":"Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation)","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963"],"score":{"baseScore":7.8,"baseSeverity":"HIGH","provider":"microsoft","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Windows Update Stack Elevation of Privilege Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}