Microsoft September 2026 Patch Tuesday Zero Day-- CVE-2026-81963: WU Stack Link-Following Local Privilege Escalation
Detects suspected exploitation of CVE-2026-81963, an Elevation of Privilege vulnerability in the Windows Update stack. The rule monitors for the creation of reparse points, junctions, or symbolic links within update staging paths by Windows Update processes, followed by either the spawning of suspicious child processes or unauthorized file writes/renames outside of expected directories, which are indicative of a privileged link-following exploit.
Microsoft Sentinel (KQL)
