CVE-2026-81963: Why a Windows Update Stack Flaw Matters More Than Its 7.8 Score
CVE-2026-81963: Why a Windows Update Stack Flaw Matters More Than Its 7.8 Score
CVE-2026-81963：为何 Windows 更新堆栈漏洞的严重性远超其 7.8 的评分
Microsoft’s September 2026 Patch Tuesday fixed 974 CVEs, the largest monthly release the company has shipped. Two of those flaws were already being exploited when the patches went out. One of them, CVE-2026-81963, sits inside the Windows Update Stack, the component that distributes patches. 微软 2026 年 9 月的“补丁星期二”修复了 974 个 CVE 漏洞，这是该公司有史以来发布规模最大的月度更新。其中两个漏洞在补丁发布时就已经被利用。其中一个漏洞 CVE-2026-81963 位于 Windows 更新堆栈（Windows Update Stack）中，该组件负责分发补丁。
The flaw CVE-2026-81963 is a local privilege escalation rated CVSS 7.8. It combines two weakness classes: CWE-59, improper link resolution before file access, and improper access control. The Windows Update Stack resolves file paths without properly validating links, so a locally authenticated low-privileged attacker can cause the update stack to follow a link it should not follow. Successful exploitation raises privileges to SYSTEM. No user interaction is required, but the attacker needs local low-privileged access to the target first. That condition is why the score is 7.8 rather than critical. CVE-2026-81963 是一个本地提权漏洞，CVSS 评分为 7.8。它结合了两种弱点类型：CWE-59（文件访问前的不当链接解析）和不当访问控制。Windows 更新堆栈在解析文件路径时未对链接进行适当验证，因此，已在本地通过身份验证的低权限攻击者可以诱导更新堆栈访问其本不应访问的链接。成功利用该漏洞可将权限提升至 SYSTEM 级别。虽然不需要用户交互，但攻击者首先需要获得目标的本地低权限访问权限。正是这一前提条件使得该漏洞的评分定为 7.8 而非“严重”（Critical）。
Why the location changes the risk: The Windows Update Stack handles patch distribution. A flaw there means an attacker can target machines that are already patched, because the mechanism used to keep the system current is itself the attack surface. Tenable counted this as the seventh privilege escalation flaw in the Windows Update Stack since 2022. The previous six were not exploited in the wild. This is the first that is both a zero-day and confirmed as exploited. 为何漏洞位置改变了风险等级：Windows 更新堆栈负责补丁分发。该组件出现漏洞意味着攻击者可以针对已经打过补丁的机器进行攻击，因为用于保持系统更新的机制本身就成了攻击面。Tenable 统计显示，这是自 2022 年以来 Windows 更新堆栈中出现的第七个提权漏洞。前六个漏洞并未在野外被利用。这是第一个既是零日漏洞又被确认已遭利用的漏洞。
Rapid7’s analysis of the patch describes the fix as tightening control so the update stack no longer follows malicious links and cannot be tricked into letting an attacker-controlled file overwrite a system component. The second exploited zero-day in the same release, CVE-2026-85880, is a heap buffer overflow in Windows ALPC rated CVSS 7.8. A low-privileged AppContainer can escape the sandbox and reach SYSTEM. Microsoft had not patched ALPC since January 2023, when CVE-2023-21674 was addressed. Both flaws are local privilege escalations. On their own they do not give an attacker a way in. They are the step that turns a foothold into control, and they appear in the middle of a chain that typically runs phishing, then a remote flaw, then escalation, then persistence. Rapid7 对该补丁的分析指出，修复方案加强了控制，使更新堆栈不再跟随恶意链接，也无法被诱导去覆盖系统组件。同批次中被利用的第二个零日漏洞是 CVE-2026-85880，这是一个 Windows ALPC 中的堆缓冲区溢出漏洞，CVSS 评分为 7.8。低权限的 AppContainer 可以借此逃逸沙箱并获得 SYSTEM 权限。自 2023 年 1 月修复 CVE-2023-21674 以来，微软一直未对 ALPC 进行过补丁更新。这两个漏洞均为本地提权漏洞。它们本身并不能为攻击者提供入侵途径，而是将“立足点”转化为“控制权”的关键步骤，通常出现在攻击链的中段——即在钓鱼攻击、远程漏洞利用之后，提权之前，并最终实现持久化。
The remote flaws deserve separate attention: The same release contains roughly 20 vulnerabilities that ZDI assesses as wormable, meaning pre-authentication, zero-interaction remote code execution. Several carry CVSS 9.8: CVE-2026-69730 (Windows DNS Server), CVE-2026-69525 (Windows Remote Desktop Services), CVE-2026-69595 and CVE-2026-78445 (Windows Services for NFS ONCRPC XDR), CVE-2026-69829 (Windows Shell), CVE-2026-73009 (Windows SSTP), CVE-2026-69590 (Windows RRAS), CVE-2026-72982 (Windows Netlogon), CVE-2026-69845 (Windows DHCP Server), CVE-2026-69769 (Windows HTTP print provider), and CVE-2026-69579 (Windows Message Queuing). CVE-2026-55007 in Exchange Server is notable for its trigger: a malicious Visio attachment in an email is processed by the server, and the recipient does not need to open the attachment. 远程漏洞值得特别关注：此次发布中包含约 20 个被 ZDI 评估为“蠕虫级”的漏洞，即无需身份验证、零交互的远程代码执行（RCE）漏洞。其中多个漏洞的 CVSS 评分为 9.8，包括：CVE-2026-69730（Windows DNS 服务器）、CVE-2026-69525（Windows 远程桌面服务）、CVE-2026-69595 和 CVE-2026-78445（Windows NFS ONCRPC XDR 服务）、CVE-2026-69829（Windows Shell）、CVE-2026-73009（Windows SSTP）、CVE-2026-69590（Windows RRAS）、CVE-2026-72982（Windows Netlogon）、CVE-2026-69845（Windows DHCP 服务器）、CVE-2026-69769（Windows HTTP 打印提供程序）以及 CVE-2026-69579（Windows 消息队列）。Exchange Server 中的 CVE-2026-55007 因其触发方式而引人注目：服务器处理电子邮件中的恶意 Visio 附件时即可触发，收件人无需打开附件。
Prioritization: CISA added both exploited zero-days to the Known Exploited Vulnerabilities catalog on 8 September 2026 with a federal deadline of 22 September 2026. The instinct to rank local privilege escalation below remote code execution is reasonable in the abstract, but it misreads this release. The exploited flaws are local, and the remote flaws are numerous and reachable. Both groups need attention, and the ordering should follow exposure rather than score. 优先级排序：CISA 于 2026 年 9 月 8 日将这两个被利用的零日漏洞加入“已知被利用漏洞目录”（KEV），并设定联邦机构的修复截止日期为 2026 年 9 月 22 日。从抽象角度看，将本地提权漏洞的优先级排在远程代码执行漏洞之后是合理的，但这误读了此次发布的性质。被利用的漏洞是本地的，而远程漏洞数量众多且易于触达。两类漏洞都需要关注，排序应根据暴露风险而非评分来决定。
A practical sequence: Patch internet-reachable services first: DNS, RDP, RRAS, Netlogon, DHCP, and Exchange. These are the pre-authentication RCEs with the widest reach. Patch domain controllers next, since Netlogon and Kerberos flaws affect authentication infrastructure. Apply the September cumulative update broadly. Windows 11 24H2 and 25H2 receive it as KB5124008, build 26100.9445 or 26200.9445. Treat the local escalation flaws as part of a chain. If an attacker already has a foothold, these flaws convert it into SYSTEM, so endpoint detection for unusual process elevation still matters. Microsoft has tightened its recommended installation window for critical quality updates to under three days, citing the speed at which attackers can find and use known gaps. The volume of this release is itself a factor: 974 fixes across Windows, Office, Azure, Exchange, SharePoint, and SQL Server is more than most teams can validate quickly. 实操建议顺序：首先修补面向互联网的服务：DNS、RDP、RRAS、Netlogon、DHCP 和 Exchange。这些是影响范围最广的无需身份验证的 RCE 漏洞。其次修补域控制器，因为 Netlogon 和 Kerberos 漏洞会影响身份验证基础设施。全面应用 9 月份的累积更新。Windows 11 24H2 和 25H2 的更新编号为 KB5124008，版本号为 26100.9445 或 26200.9445。将本地提权漏洞视为攻击链的一部分来处理。如果攻击者已经获得了立足点，这些漏洞会将权限提升至 SYSTEM，因此针对异常进程提权的端点检测依然至关重要。微软已将其关键质量更新的建议安装窗口缩短至三天以内，理由是攻击者发现并利用已知漏洞的速度极快。此次发布的规模本身也是一个因素：涵盖 Windows、Office、Azure、Exchange、SharePoint 和 SQL Server 的 974 个修复程序，超出了大多数团队能够快速验证的范围。