CVE-2026-81963: Why a Windows Update Stack Flaw Matters More Than Its 7.8 Score

Microsoft's September 2026 Patch Tuesday fixed 974 CVEs, the largest monthly release the company has shipped. Two of those flaws were already being exploited when the patches went out. One of them, CVE-2026-81963, sits inside the Windows Update Stack, the component that distributes patches.

The flaw

CVE-2026-81963 is a local privilege escalation rated CVSS 7.8. It combines two weakness classes: CWE-59, improper link resolution before file access, and improper access control. The Windows Update Stack resolves file paths without properly validating links, so a locally authenticated low-privileged attacker can cause the update stack to follow a link it should not follow. Successful exploitation raises privileges to SYSTEM.

No user interaction is required, but the attacker needs local low-privileged access to the target first. That condition is why the score is 7.8 rather than critical.

Why the location changes the risk

The Windows Update Stack handles patch distribution. A flaw there means an attacker can target machines that are already patched, because the mechanism used to keep the system current is itself the attack surface. Tenable counted this as the seventh privilege escalation flaw in the Windows Update Stack since 2022. The previous six were not exploited in the wild. This is the first that is both a zero-day and confirmed as exploited.

Rapid7's analysis of the patch describes the fix as tightening control so the update stack no longer follows malicious links and cannot be tricked into letting an attacker-controlled file overwrite a system component.

The second exploited zero-day in the same release, CVE-2026-85880, is a heap buffer overflow in Windows ALPC rated CVSS 7.8. A low-privileged AppContainer can escape the sandbox and reach SYSTEM. Microsoft had not patched ALPC since January 2023, when CVE-2023-21674 was addressed.

Both flaws are local privilege escalations. On their own they do not give an attacker a way in. They are the step that turns a foothold into control, and they appear in the middle of a chain that typically runs phishing, then a remote flaw, then escalation, then persistence.

The remote flaws deserve separate attention

The same release contains roughly 20 vulnerabilities that ZDI assesses as wormable, meaning pre-authentication, zero-interaction remote code execution. Several carry CVSS 9.8:

• CVE-2026-69730, Windows DNS Server, use-after-free, pre-authentication RCE.
• CVE-2026-69525, Windows Remote Desktop Services, use-after-free, pre-authentication RCE.
• CVE-2026-69595 and CVE-2026-78445, Windows Services for NFS ONCRPC XDR, use-after-free, pre-authentication RCE.
• CVE-2026-69829, Windows Shell, heap buffer overflow, pre-authentication RCE.
• CVE-2026-73009, Windows SSTP, pre-authentication RCE.
• CVE-2026-69590, Windows RRAS, heap buffer overflow, pre-authentication RCE.
• CVE-2026-72982, Windows Netlogon, pre-authentication RCE.
• CVE-2026-69845, Windows DHCP Server, heap buffer overflow, pre-authentication RCE.
• CVE-2026-69769, Windows HTTP print provider, heap buffer overflow, pre-authentication RCE.
• CVE-2026-69579, Windows Message Queuing, use-after-free, pre-authentication RCE.

CVE-2026-55007 in Exchange Server is notable for its trigger. A malicious Visio attachment in an email is processed by the server, and the recipient does not need to open the attachment.

Prioritization

CISA added both exploited zero-days to the Known Exploited Vulnerabilities catalog on 8 September 2026 with a federal deadline of 22 September 2026.

The instinct to rank local privilege escalation below remote code execution is reasonable in the abstract, but it misreads this release. The exploited flaws are local, and the remote flaws are numerous and reachable. Both groups need attention, and the ordering should follow exposure rather than score.

A practical sequence:

1. Patch internet-reachable services first: DNS, RDP, RRAS, Netlogon, DHCP, and Exchange. These are the pre-authentication RCEs with the widest reach.
2. Patch domain controllers next, since Netlogon and Kerberos flaws affect authentication infrastructure.
3. Apply the September cumulative update broadly. Windows 11 24H2 and 25H2 receive it as KB5124008, build 26100.9445 or 26200.9445.
4. Treat the local escalation flaws as part of a chain. If an attacker already has a foothold, these flaws convert it into SYSTEM, so endpoint detection for unusual process elevation still matters.

Microsoft has tightened its recommended installation window for critical quality updates to under three days, citing the speed at which attackers can find and use known gaps. The volume of this release is itself a factor: 974 fixes across Windows, Office, Azure, Exchange, SharePoint, and SQL Server is more than most teams can validate quickly.

References

• Microsoft Security Response Center advisories for CVE-2026-81963 and CVE-2026-85880, September 2026.
• CISA Known Exploited Vulnerabilities catalog, entries added 8 September 2026, federal deadline 22 September 2026.
• Tenable analysis of the September 2026 Microsoft Patch Tuesday release.
• Rapid7 analysis of the Windows Update Stack patch.
• ZDI assessment of wormable vulnerabilities in the September 2026 release.