Local privilege escalation through link following in Microsoft Windows Update Stack

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

• Windows 11 version 23H2 and Windows 11 Version 23H2: affected from 10.0.22631.0 through versions less than 10.0.22631.7582.
• Windows 11 Version 24H2: affected from 10.0.26100.0 through versions less than 10.0.26100.9445.
• Windows 11 Version 25H2: affected from 10.0.26200.0 through versions less than 10.0.26200.9445.
• Windows 11 version 26H1: affected from 10.0.28000.0 through versions less than 10.0.28000.2954.
• Windows Server 2025 and Windows Server 2025 (Server Core installation): affected from 10.0.26100.0 through versions less than 10.0.26100.33438.

The record does not establish the status of branches or products outside this list.

The flaw is in Windows Update Stack and is classified as CWE-59, improper link resolution before file access, with an associated access-control weakness. An authorized attacker who already has low privileges on the machine can reach the vulnerable file-access operation without requiring another user's interaction. The supplied assessment describes a local attack path with low complexity and no additional authentication requirement beyond the attacker's existing access. The record does not disclose the API, path, link type, file operation, or precise configuration condition that causes the flaw. If successfully exploited, the attacker may gain higher privileges within the same security scope on the affected host.

The record describes local exploitation by an authorized attacker with low privileges. The attack does not require user interaction and is assessed as low complexity. The record marks the vulnerability as known exploited and publicly exploitable. It does not identify a specific exploit, payload, threat actor, victim, or campaign.

• Successful exploitation allows local privilege elevation on the affected host, while the supplied assessment describes unchanged security scope.
• The supplied impact assessment indicates high consequences for confidentiality, integrity, and availability.
• The attacker needs local access and low initial privileges, but does not need user interaction or a complex attack condition.
• The specific post-escalation actions, such as what operations can be performed or what data can be accessed, are not established by the available evidence.

• Workstations or servers running an affected build could allow an attacker with local access to obtain additional privileges on the same system.
• Successful elevation could undermine the confidentiality, integrity, and availability of data and services on the affected host.
• Because the attack path is local, the flaw does not by itself describe a remote entry point; organizations should still assess local accounts, sessions, and software that could provide the initial foothold.
• Known exploitation and a public exploit increase operational risk for unpatched assets. The record does not confirm a specific intrusion, ransomware campaign, or loss event.

1. Identify the Windows branch and build on each asset, then install Microsoft's security update that brings Windows 11 version 23H2 to build 10.0.22631.7582.
2. For Windows 11 Version 24H2, install the update that brings the system to build 10.0.26100.9445.
3. For Windows 11 Version 25H2, install the update that brings the system to build 10.0.26200.9445; for Windows 11 version 26H1, bring the system to build 10.0.28000.2954.
4. For Windows Server 2025, including Server Core, install the update that brings the system to build 10.0.26100.33438.
5. Verify the build after updating in patch-management systems and handle each branch separately. A fix for one branch should not be treated as evidence that other branches are covered. The record does not provide an alternative mitigation beyond updating.

• Inventory systems running Windows 11 version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1, and Windows Server 2025, including Server Core installations.
• Record the actual OS build on each system and compare it with the affected ranges in affected_summary.
• Check patch-management data to confirm that the applicable security update for each branch is installed.
• Prioritize systems below the remediation build boundaries because the record states that the vulnerability has been exploited and is publicly exploitable.
• No specific IOC, log event, or telemetry pattern is provided. EDR and privilege-related logs may be reviewed as precautionary monitoring, but absence of an event does not establish that a system is safe.