Windows Update Stack CVE-2026-81963

The attacker must hold a valid local or domain user account on the target system (PR:L; standard user, not guest). No non-default configuration is required - the Windows Update Stack is present and active on all standard Windows 11 and Server 2025 installations. The attacker must be able to create symlinks or NTFS junctions at a specific path and time the planting relative to a Windows Update Stack operation; SSVC Automatable 'no' indicates this timing dependency limits mass exploitation. No victim interaction is required (UI:N). What limits exploitation: the attack vector is strictly local (AV:L) - the attacker must already have an interactive session, scheduled task context, or equivalent code execution on the target machine; this vulnerability is not standalone remotely exploitable. The requirement for path-timing precision (per SSVC non-automatable) favors targeted over opportunistic use.

CISA KEV confirms active in-the-wild exploitation, establishing this as a genuine, urgent priority. A notable conflict exists in the provided data: the SSVC feed rates Exploitation as 'none' while CISA KEV simultaneously flags confirmed exploitation - this likely reflects a data entry lag in the SSVC feed, and KEV should be treated as the authoritative signal. The CVSS 7.8 AV:L/AC:L/PR:L/UI:N vector indicates low complexity for any authenticated local user on a default configuration, with no user interaction required. Full C:H/I:H/A:H impact is consistent with SYSTEM-level compromise, and SSVC Technical Impact rated 'total' corroborates this. The local attack vector (AV:L) prevents direct remote exploitation in isolation but is commonly chained after an initial access vector such as phishing-delivered malware, a sandboxed process escape, or a web-facing RCE. SSVC Automatable 'no' suggests per-target timing or path customization is required, which may limit mass exploitation but does not reduce urgency for targeted attack scenarios.

A threat actor with a standard domain or local user account on a vulnerable Windows 11 or Server 2025 host plants an NTFS symlink or object directory junction at a path traversed by the Windows Update Stack during a privileged update operation. When the Update Stack process (running as SYSTEM) resolves the link and performs a subsequent file write, the attacker redirects that write to a protected system location - such as overwriting a service binary or injecting a new local administrator account - achieving persistent SYSTEM-level code execution. CISA KEV confirmation implies functional exploit code exists in attacker hands, though no named public proof-of-concept is attributed in the available data.