CVE-2026-81963 · Windows Update Stack Elevation of Privilege Vulnerability

01 · The Real Story

Someone left the loading dock wide open — any employee with a badge can walk into the server room

CVE-2026-81963 is a symlink/junction-following flaw (CWE-59) in the Windows Update Stack. A standard-privilege local user can replace or junction the C:\ProgramData\Microsoft\UpdateStack\Tasks directory to a user-controlled path. When SYSTEM-level update processes — MoUsoCoreWorker.exe, UsoClient.exe, or TiWorker.exe — activate on schedule, they follow the junction and execute the attacker's payload with full SYSTEM privileges. Affected builds span Windows 11 23H2 (10.0.22631.x before .7582), Windows 11 24H2 (10.0.26100.x before .9445), Windows 11 26H2 (10.0.26200.x before .9445), and Windows Server 2025 (10.0.28000.x before .2954). Patches shipped in the September 2026 Patch Tuesday via KB5122871 and KB5122876.

Microsoft rates this Important / 7.8, which would be fair for a garden-variety local EoP — except they simultaneously confirm active exploitation in the wild as a zero-day before a fix existed. That combination deserves a bump. The technique requires no code injection, no memory corruption, and no special configuration: just mklink /J from a standard user account. It bypasses most EDR heuristics because it uses only native NTFS operations and legitimate Windows Update binaries. The 7.8 score captures the local-only access vector correctly, but undersells the operational reality: adversaries are already chaining this in post-compromise scenarios against high-value targets, and the universal Windows footprint means every host in your fleet is a candidate.

"Actively exploited zero-day turns any standard user into SYSTEM via Windows Update junction hijack."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Gain local user session

The attacker obtains an interactive or scripted session as any low-privilege domain user on the target host. This can arrive via phishing, RDP with stolen creds, lateral movement from a compromised workstation, or a supply-chain implant. No admin rights are needed — a standard domain user suffices.

Conditions required:

Authenticated local access to a Windows host (any privilege level)

Where this breaks in practice:

Requires prior initial access — this is a post-compromise technique, not a remote entry point

Detection/coverage: EDR telemetry on new logon sessions; anomalous RDP or PSExec events

STEP 02

Delete or replace UpdateStack Tasks directory

The attacker removes or renames C:\ProgramData\Microsoft\UpdateStack\Tasks and creates an NTFS junction (mklink /J) pointing to a user-controlled directory such as C:\Users\<user>\AppData\Roaming\Microsoft\UpdateStack\Tasks\. Standard users can create junctions to directories they control. No elevation is required for this filesystem operation.

Conditions required:

Write access to C:\ProgramData\Microsoft\UpdateStack\ (default ACLs permit this for authenticated users)
Target host has not applied September 2026 cumulative update

Where this breaks in practice:

If directory ACLs have been hardened beyond defaults, junction creation fails
AppLocker or WDAC policies blocking cmd.exe /c mklink from user context could interfere, but PowerShell and .NET alternatives exist

Detection/coverage: Sysmon Event ID 11 (FileCreate) or Event ID 1 (ProcessCreate) for mklink /J referencing UpdateStack; custom Defender for Endpoint detection rules on junction creation in ProgramData

STEP 03

Stage payload in junction target

The attacker drops a PowerShell script, DLL, or executable into the junction-target directory. Because the junction now redirects the trusted path, the Windows Update Stack will resolve this payload as if it lived in the legitimate Tasks folder. No signature or integrity check is performed on the file content.

Conditions required:

Junction successfully created in step 2
Payload file placed in user-controlled directory

Where this breaks in practice:

Real-time AV/EDR may flag known malicious payloads on disk — but the technique itself uses no exploit shellcode, so novel payloads evade signature detection

Detection/coverage: File-write telemetry in user AppData referencing UpdateStack paths; AMSI for PowerShell payloads if script-based

STEP 04

Wait for SYSTEM-level update process activation

Windows Update processes (MoUsoCoreWorker.exe, UsoClient.exe, TiWorker.exe) run on a schedule or can be triggered by the attacker via UsoClient StartInteractiveScan. These processes run as NT AUTHORITY\SYSTEM and follow the junction without validating the reparse point, executing the staged payload with full SYSTEM privileges.

Conditions required:

Windows Update service (wuauserv) is running (default on all supported Windows)
Scheduled task or manual trigger activates the update scan

Where this breaks in practice:

If Windows Update service is disabled (rare in enterprise — breaks patching), the chain breaks
Hosts in maintenance windows with update services paused may delay exploitation

Detection/coverage: Process creation events showing SYSTEM-level processes spawning unexpected child processes; ETW tracing on UpdateStack execution paths

STEP 05

SYSTEM shell achieved — post-exploitation

With SYSTEM on the host, the attacker can dump credentials (LSA secrets, cached domain creds), install persistence, pivot laterally, or — on a domain controller — extract the NTDS.dit and own the entire Active Directory domain. On Hyper-V hosts, SYSTEM grants hypervisor management access. On backup servers, SYSTEM can delete or encrypt backup catalogs.

Conditions required:

Payload successfully executed as SYSTEM in step 4

Where this breaks in practice:

Credential Guard on modern Windows 11 limits plaintext credential theft
LSASS protection (PPL) raises the bar for memory dumps, though SYSTEM can often bypass via driver loading

Detection/coverage: Credential access alerts (Mimikatz signatures, LSASS access); anomalous service installations; DCSync detection on DCs

03 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	Confirmed active. Microsoft acknowledges exploitation before patch availability — this is a true zero-day. No named campaign or threat actor attributed yet.
CISA KEV Status	Not yet listed as of 2026-09-09. CVE published 2026-09-08; KEV addition expected imminently given Microsoft's confirmation of active exploitation.
Proof-of-Concept	No public PoC specific to CVE-2026-81963. However, the technique is identical in class to CVE-2025-21204 which has a full public PoC (`Exploit-CVE2025-UpdateStackLPE-NonAdmin.ps1` on GitHub). Adapting to the new code path is trivial.
EPSS Score	Not yet scored (CVE published <24 hours ago). Expect high percentile given the active-exploitation flag and low-complexity attack path.
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` — Local access, low complexity, low privilege, no user interaction. Temporal: Exploit Functional (E:F), Official Remediation (RL:O), Confirmed (RC:C). The E:F temporal modifier is significant — functional exploit code exists in adversary hands.
Affected Versions	Windows 11 23H2 (<10.0.22631.7582), Windows 11 24H2 (<10.0.26100.9445), Windows 11 26H2 (<10.0.26200.9445), Windows Server 2025 (<10.0.28000.2954). Essentially every supported Windows desktop and server build.
Fixed Versions	KB5122871 (Windows 11 consumer/Pro), KB5122876 (Windows Server 2025). Cumulative updates — September 2026 Patch Tuesday.
Scanning/Exposure	This is a local vulnerability — no external exposure surface visible to Shodan/Censys/GreyNoise. Every unpatched Windows host in your fleet is vulnerable. Scanner coverage: Qualys QID expected in VulnSigs 2026-09-09; Tenable plugin anticipated within 48 hours of Patch Tuesday.
Disclosure Date	2026-09-08 (September Patch Tuesday). Reserved 2026-08-27. Exploited before disclosure (zero-day).
Researcher	Not publicly credited. Microsoft has not attributed discovery to an external researcher — may be an internal MSRC find from incident response to active exploitation.

04 · The Call

noisgate verdict.

Final Verdict

= UNCHANGED to HIGH (8.2/10)

The single most decisive factor is confirmed active zero-day exploitation of a vulnerability class (UpdateStack junction hijack) for which a near-identical public PoC already exists, on a component present on every supported Windows host. The universal footprint and trivial weaponization — requiring only mklink /J from a standard user — override the local-access friction that would otherwise anchor this at vendor baseline.

HIGH Vulnerability existence and active exploitation (confirmed by Microsoft)

HIGH Attack technique mechanics (identical to well-documented CVE-2025-21204 class)

MEDIUM Blast radius on DCs and high-value roles (inferred from SYSTEM access, not directly observed in campaigns)

LOW Threat actor attribution and campaign scope (Microsoft has not disclosed details)

Why this verdict

Active zero-day exploitation: Microsoft confirms in-the-wild use before a patch existed. This is not theoretical — adversaries have functional exploit code and are deploying it now.
Universal attack surface: The Windows Update Stack is present and enabled by default on every supported Windows desktop and server. Your entire fleet of 10,000 hosts is in scope, not a niche subset.
Trivial weaponization with prior art: The junction-hijack technique is identical to CVE-2025-21204, which has a full public PoC on GitHub. Adapting to this new code path requires minimal effort — expect broad availability within days.
Role multiplier: On domain controllers, SYSTEM access = domain admin equivalent → NTDS.dit extraction → full AD compromise. On Hyper-V hosts, SYSTEM = hypervisor management → guest VM compromise. On backup servers (Veeam, DPM), SYSTEM = backup destruction. DCs alone represent ≥2-5% of enterprise Windows Server deployments, and Windows Server 2025 is explicitly affected. The worst-case blast radius is fleet-scale domain compromise.
EDR evasion by design: The technique uses only native NTFS junction operations and legitimate Windows Update binaries — no shellcode, no injection, no memory corruption. Most behavioral EDR heuristics miss this entirely.

Why not higher?

CRITICAL would require either unauthenticated remote access or a component that is *canonically* a high-value-role product (≥10% of installs in the high-value tier by definition). The Windows Update Stack is a universal OS component, not identity/hypervisor/backup-specific software. The local-access prerequisite (AV:L, PR:L) means an attacker must already have a foothold on the target host — this is post-compromise escalation, not initial access. While the DC blast radius is severe, standard Windows installations are not DCs, so the high-value role share is ~2-5% of the installed base, not ≥10%.

Why not lower?

Confirmed active zero-day exploitation removes any theoretical discount — adversaries are using this *right now*. The technique is trivially reproducible from existing public research, the attack surface is every Windows host in the fleet, and the blast radius on DCs/hypervisors is domain-scale. Dropping to MEDIUM would ignore the exploitation evidence and the near-zero friction once local access is obtained.

05 · Compensating Control

What to do — in priority order.

Harden ACLs on the UpdateStack directory immediately — Run icacls "C:\ProgramData\Microsoft\UpdateStack" /inheritance:r /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)F" "BUILTIN\Administrators:(OI)(CI)F" via GPO or SCCM to remove standard-user write access. This breaks the junction-creation step without affecting update functionality. Deploy within 3 days per noisgate mitigation SLA for HIGH with active exploitation override (treat as immediate).
Deploy Sysmon or EDR detection for junction creation in ProgramData — Create a detection rule for mklink /J or NtCreateFile with IO_REPARSE_TAG_MOUNT_POINT targeting any path under C:\ProgramData\Microsoft\UpdateStack. Alert and auto-isolate. Deploy within 24 hours as a detection backstop.
Restrict UsoClient trigger from non-admin users — Block UsoClient.exe StartInteractiveScan execution by non-administrators via AppLocker or WDAC rule. This prevents attackers from triggering the update scan on demand, forcing them to wait for the natural schedule (adding latency but not eliminating the risk). Deploy within 3 days.
Prioritize patching on domain controllers and Hyper-V hosts — Apply KB5122871/KB5122876 to DCs, Hyper-V hosts, backup servers, and SCCM servers within 24 hours. These are the hosts where SYSTEM access has fleet-scale consequences. Use your emergency change window.
Enable Credential Guard and LSASS PPL on DCs — Even if the attacker achieves SYSTEM, Credential Guard prevents plaintext credential extraction and LSASS PPL blocks unsigned memory dumps. This limits post-exploitation yield on the highest-value targets. Should already be enabled; verify and enforce via GPO.

What doesn't work

Network segmentation / firewall rules — This is a local privilege escalation, not a network attack. Segmenting the host from the network does not prevent a user already logged in from creating junctions.
Disabling Windows Update service — While this breaks the chain, it also breaks your patching pipeline. You'd be trading one vulnerability for permanent exposure to all future vulnerabilities. Do not do this in production.
Standard antivirus signatures — The attack uses only native OS binaries and NTFS features. There is no malware binary to signature-match until the final payload stage, and novel payloads will evade static detection.

06 · Verification

Crowdsourced verification payload.

Run this on each target Windows host as a local administrator. Execute: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-81963.ps1. Requires admin rights to read OS build numbers accurately. Returns VULNERABLE, PATCHED, or UNKNOWN.

noisgate-verify.ps1

POWERSHELLREAD-ONLYSAFE

#Requires -RunAsAdministrator
<#
  Check-CVE-2026-81963.ps1
  Checks whether the current Windows build is patched against CVE-2026-81963
  (Windows Update Stack EoP via junction following).
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$build = [System.Environment]::OSVersion.Version
$fullBuild = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR
$major = $build.Build

# Define patched UBR thresholds per major build
$patchedVersions = @{
    22631 = 7582   # Windows 11 23H2
    26100 = 9445   # Windows 11 24H2
    26200 = 9445   # Windows 11 26H2
    28000 = 2954   # Windows Server 2025
}

Write-Host "[*] OS Build: $major.$fullBuild"

if ($patchedVersions.ContainsKey($major)) {
    $required = $patchedVersions[$major]
    if ($fullBuild -ge $required) {
        Write-Host "PATCHED - Build $major.$fullBuild meets or exceeds fix threshold $major.$required"
        exit 0
    } else {
        Write-Host "VULNERABLE - Build $major.$fullBuild is below fix threshold $major.$required"
        # Also check if junction exploit is currently active
        $updateStackPath = "$env:ProgramData\Microsoft\UpdateStack\Tasks"
        if (Test-Path $updateStackPath) {
            $item = Get-Item $updateStackPath -Force
            if ($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) {
                Write-Host "WARNING: $updateStackPath is a reparse point (junction/symlink) - possible active exploitation!"
            }
        }
        exit 1
    }
} else {
    Write-Host "UNKNOWN - Build $major is not in the known affected range. Verify manually."
    exit 2
}

07 · Bottom Line

If you remember one thing.

TL;DR

This is an actively exploited zero-day affecting every supported Windows build in your fleet. Patch domain controllers, Hyper-V hosts, and backup servers within 24 hours using KB5122871/KB5122876 — active exploitation overrides the standard noisgate mitigation SLA and demands immediate action. For the remaining fleet, harden ACLs on C:\ProgramData\Microsoft\UpdateStack via GPO today as a compensating control, then complete full patch rollout within the 30-day noisgate remediation SLA for HIGH. Deploy Sysmon or EDR junction-creation detections immediately to catch exploitation attempts in the gap. Do not wait for CISA KEV listing — Microsoft's own confirmation of in-the-wild exploitation is sufficient to treat this as an emergency.

Sources

Peer Review

What defenders are saying.

Submit a review attribution: handle + country only

0 flags selected · stored anonymously

Validation Results

Crowdsourced verification outputs.

Results submitted by users who ran the verification payload against their environment.