CVE-2026-81963: CWE-59: Improper Link Resolution Before File Access ('Link Following') in Microsoft Windows 11 version 23H2
104 Critical 860 Important 0 Moderate 0 Low Microsoft addresses 964 CVEs, smashing July’s release as the largest Patch Tuesday release. This month’s updates include patches for two zero-days that were exploited in the wild. Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated as important. This month’s update includes patches for: .NET .NET and Visual Studio ASP.NET Core Active Directory Certificate Services (AD CS) Active Directory Domain Services Active Directory Federation Services (AD FS) Audio Video Control Transport Protocol Azure Arc Azure CycleCloud Azure HDInsights BranchCache Connected Devices Platform Service (Cdpsvc) Data Sharing Service Client GitHub Copilot and Visual Studio Code Graphic Fonts HID class driver IP Helper Internet Storage Name Service Kernel Streaming WOW Thunk Service Driver Microsoft Account Microsoft Authenticator Microsoft Azure Attestation service and Device Health Attestation Service Microsoft Azure CLI Microsoft COM for Windows Microsoft Dynamics 365 Microsoft Exchange Server Microsoft Graphics Component Microsoft Install Service Microsoft JScript Microsoft Local Security Authority Server (lsasrv) Microsoft Office Microsoft Office Access Microsoft Office Excel Microsoft Office Outlook Microsoft Office PowerPoint Microsoft Office Publisher Microsoft Office SharePoint Microsoft Office Word Microsoft Standard XPS Microsoft Teams for Android Microsoft Trace Data Helper Microsoft UxTheme Library (uxtheme.dll) Microsoft WDAC OLE DB provider for SQL Microsoft WebP Image Extension Microsoft Windows Codecs Library Microsoft Windows Media Foundation Microsoft Windows PDF Microsoft Windows SCSI Class System File Microsoft Windows Search Component Microsoft Windows Speech OpenSSH for Windows Power Automate Push Message Routing Service RPC Runtime Reliable Multicast Transport Driver (RMCAST) Remote Desktop Client Remote Desktop Gateway Service Role: DNS Server Role: Windows Fax Service SQL Server Skype for Business Spring Cloud Azure Storage Port Driver Telnet Client Virtual Hard Disk (VHD) Miniport Driver Visual Studio Visual Studio Code Volume Manager Driver Windows AF_UNIX Socket Provider Windows ALPC Windows Accounts Control Windows Ancillary Function Driver for WinSock Windows Audio Service Windows Authentication Methods Windows Autopilot Windows Bind Filter Driver Windows Biometric Service Windows BitLocker Windows Bluetooth Port Driver Windows Bluetooth Service Windows Boot Manager Windows Broadcast DVR User Service Windows Broker Infrastructure Service Windows CD-ROM Driver Windows Camera Frame Server Monitor Windows Cloud Files Mini Filter Driver Windows Compressed Folder Windows Connected User Experiences and Telemetry Windows Container Manager Service Windows Core Messaging Windows Credential Guard Windows Credential Providers Windows DCOM Server Windows DHCP Client Windows DHCP Server Windows DNS Windows DWM Core Library Windows Defender Firewall Service Windows Deployment Services Windows Device Association Broker service Windows Device Association Service Windows Devices Human Interface Windows Direct Show Windows Display Enhancement Service Windows Distributed File System (DFS) Windows Embedded Mode Service Windows Encrypting File System (EFS) Windows Enterprise App Management Windows Error Reporting Windows Event Logging Service Windows Failover Cluster Windows Fast FAT Driver Windows File History Service Windows GDI Windows GDI+ Windows Graphics Kernel Windows Group Policy Windows HTTP Print Provider Windows HTTP.sys Windows Hello Windows Host Guardian Service Windows Hyper-V Windows IKE Extension Windows IP Address Management (IPAM) Service Windows Image Acquisition Windows Imaging Component Windows Installer Windows Internet Connection Sharing (ICS) Windows Kerberos Windows Kernel Windows Kernel Mode Driver Windows Key Distribution Center Windows LDAP - Lightweight Directory Access Protocol Windows License Manager Window…
AI Analysis
Technical Summary
This vulnerability, identified as CWE-59 (Improper Link Resolution Before File Access), affects the Windows Update Stack in Windows 11 version 23H2 (build 10.0.22631.0). It allows an authorized local attacker to elevate their privileges by exploiting improper handling of symbolic links or similar link types before accessing files. The CVSS v3.1 base score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Microsoft has published an official fix to remediate this issue.
Potential Impact
Successful exploitation allows an authorized local attacker to elevate privileges on the affected system, potentially gaining higher-level access than intended. This can lead to full system compromise, affecting confidentiality, integrity, and availability of the system.
Mitigation Recommendations
An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963 to remediate this vulnerability.
CVE-2026-81963: CWE-59: Improper Link Resolution Before File Access ('Link Following') in Microsoft Windows 11 version 23H2
Description
104 Critical 860 Important 0 Moderate 0 Low Microsoft addresses 964 CVEs, smashing July’s release as the largest Patch Tuesday release. This month’s updates include patches for two zero-days that were exploited in the wild. Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated as important. This month’s update includes patches for: .NET .NET and Visual Studio ASP.NET Core Active Directory Certificate Services (AD CS) Active Directory Domain Services Active Directory Federation Services (AD FS) Audio Video Control Transport Protocol Azure Arc Azure CycleCloud Azure HDInsights BranchCache Connected Devices Platform Service (Cdpsvc) Data Sharing Service Client GitHub Copilot and Visual Studio Code Graphic Fonts HID class driver IP Helper Internet Storage Name Service Kernel Streaming WOW Thunk Service Driver Microsoft Account Microsoft Authenticator Microsoft Azure Attestation service and Device Health Attestation Service Microsoft Azure CLI Microsoft COM for Windows Microsoft Dynamics 365 Microsoft Exchange Server Microsoft Graphics Component Microsoft Install Service Microsoft JScript Microsoft Local Security Authority Server (lsasrv) Microsoft Office Microsoft Office Access Microsoft Office Excel Microsoft Office Outlook Microsoft Office PowerPoint Microsoft Office Publisher Microsoft Office SharePoint Microsoft Office Word Microsoft Standard XPS Microsoft Teams for Android Microsoft Trace Data Helper Microsoft UxTheme Library (uxtheme.dll) Microsoft WDAC OLE DB provider for SQL Microsoft WebP Image Extension Microsoft Windows Codecs Library Microsoft Windows Media Foundation Microsoft Windows PDF Microsoft Windows SCSI Class System File Microsoft Windows Search Component Microsoft Windows Speech OpenSSH for Windows Power Automate Push Message Routing Service RPC Runtime Reliable Multicast Transport Driver (RMCAST) Remote Desktop Client Remote Desktop Gateway Service Role: DNS Server Role: Windows Fax Service SQL Server Skype for Business Spring Cloud Azure Storage Port Driver Telnet Client Virtual Hard Disk (VHD) Miniport Driver Visual Studio Visual Studio Code Volume Manager Driver Windows AF_UNIX Socket Provider Windows ALPC Windows Accounts Control Windows Ancillary Function Driver for WinSock Windows Audio Service Windows Authentication Methods Windows Autopilot Windows Bind Filter Driver Windows Biometric Service Windows BitLocker Windows Bluetooth Port Driver Windows Bluetooth Service Windows Boot Manager Windows Broadcast DVR User Service Windows Broker Infrastructure Service Windows CD-ROM Driver Windows Camera Frame Server Monitor Windows Cloud Files Mini Filter Driver Windows Compressed Folder Windows Connected User Experiences and Telemetry Windows Container Manager Service Windows Core Messaging Windows Credential Guard Windows Credential Providers Windows DCOM Server Windows DHCP Client Windows DHCP Server Windows DNS Windows DWM Core Library Windows Defender Firewall Service Windows Deployment Services Windows Device Association Broker service Windows Device Association Service Windows Devices Human Interface Windows Direct Show Windows Display Enhancement Service Windows Distributed File System (DFS) Windows Embedded Mode Service Windows Encrypting File System (EFS) Windows Enterprise App Management Windows Error Reporting Windows Event Logging Service Windows Failover Cluster Windows Fast FAT Driver Windows File History Service Windows GDI Windows GDI+ Windows Graphics Kernel Windows Group Policy Windows HTTP Print Provider Windows HTTP.sys Windows Hello Windows Host Guardian Service Windows Hyper-V Windows IKE Extension Windows IP Address Management (IPAM) Service Windows Image Acquisition Windows Imaging Component Windows Installer Windows Internet Connection Sharing (ICS) Windows Kerberos Windows Kernel Windows Kernel Mode Driver Windows Key Distribution Center Windows LDAP - Lightweight Directory Access Protocol Windows License Manager Window…
CVSS v3.1
Score 7.8high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability, identified as CWE-59 (Improper Link Resolution Before File Access), affects the Windows Update Stack in Windows 11 version 23H2 (build 10.0.22631.0). It allows an authorized local attacker to elevate their privileges by exploiting improper handling of symbolic links or similar link types before accessing files. The CVSS v3.1 base score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Microsoft has published an official fix to remediate this issue.
Potential Impact
Successful exploitation allows an authorized local attacker to elevate privileges on the affected system, potentially gaining higher-level access than intended. This can lead to full system compromise, affecting confidentiality, integrity, and availability of the system.
Mitigation Recommendations
An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963 to remediate this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- microsoft
- Date Reserved
- 2026-08-27T20:58:07.631Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- official-fix
- Vendor Advisory Urls
- [{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963","vendor":"Microsoft"}]
Threat ID: 6aa04573acd9273b49fb8dae
Added to database: 09/08/2026, 17:27:15 UTC
Last enriched: 09/08/2026, 18:07:31 UTC
Last updated: 09/08/2026, 18:20:01 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.