[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-81963":6},{"stargazers_count":4,"fetched_at":5},7,"2026-09-09T09:01:21.974Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":974,"aliases":975,"duplicate_of":9,"upstream":976,"downstream":977,"duplicates":978,"related":979,"reserved_at":9,"published_at":980,"modified_at":981,"state":982,"summary":983,"references_raw":992,"kevs":1006,"epss":9,"epss_history":1017,"metrics":1018,"affected":1027},"CVE-2026-81963","Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.",null,[11,195],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-59","Improper Link Resolution Before File Access ('Link Following')","The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.","weakness","Draft","Base","Medium",[20,101,162,191],{"id":21,"name":22,"techniques":23},"CAPEC-132","Symlink Attack",[24],{"id":25,"name":26,"tactics":27,"countermeasures":34},"T1547.009","Shortcut Modification",[28,31],{"id":29,"name":30},"TA0110","Persistence",{"id":32,"name":33},"TA0111","Privilege Escalation",[35,40,45,49,53,57,62,67,71,75,80,84,88,92,96],{"id":36,"name":37,"tactic":38},"D3-LFP","Local File Permissions",{"name":39},"Isolate",{"id":41,"name":42,"tactic":43},"D3-DA","Dynamic Analysis",{"name":44},"Detect",{"id":46,"name":47,"tactic":48},"D3-FIM","File Integrity Monitoring",{"name":44},{"id":50,"name":51,"tactic":52},"D3-EFA","Emulated File Analysis",{"name":44},{"id":54,"name":55,"tactic":56},"D3-CM","Content Modification",{"name":39},{"id":58,"name":59,"tactic":60},"D3-FEV","File Eviction",{"name":61},"Evict",{"id":63,"name":64,"tactic":65},"D3-DF","Decoy File",{"name":66},"Deceive",{"id":68,"name":69,"tactic":70},"D3-FA","File Analysis",{"name":44},{"id":72,"name":73,"tactic":74},"D3-CF","Content Filtering",{"name":39},{"id":76,"name":77,"tactic":78},"D3-FE","File Encryption",{"name":79},"Harden",{"id":81,"name":82,"tactic":83},"D3-EAL","Executable Allowlisting",{"name":39},{"id":85,"name":86,"tactic":87},"D3-EDL","Executable Denylisting",{"name":39},{"id":89,"name":90,"tactic":91},"D3-RFAM","Remote File Access Mediation",{"name":39},{"id":93,"name":94,"tactic":95},"D3-CQ","Content Quarantine",{"name":39},{"id":97,"name":98,"tactic":99},"D3-RF","Restore File",{"name":100},"Restore",{"id":102,"name":103,"techniques":104},"CAPEC-17","Using Malicious Files",[105,142],{"id":106,"name":107,"tactics":108,"countermeasures":120},"T1574.005","Executable Installer File Permissions Weakness",[109,110,111,114,117],{"id":29,"name":30},{"id":32,"name":33},{"id":112,"name":113},"TA0030","Defense Evasion",{"id":115,"name":116},"TA0005","Stealth",{"id":118,"name":119},"TA0104","Execution",[121,125,129,134,138],{"id":122,"name":123,"tactic":124},"D3-SU","Software Update",{"name":79},{"id":126,"name":127,"tactic":128},"D3-RS","Restore Software",{"name":100},{"id":130,"name":131,"tactic":132},"D3-AVE","Asset Vulnerability Enumeration",{"name":133},"Model",{"id":135,"name":136,"tactic":137},"D3-SWI","Software Inventory",{"name":133},{"id":139,"name":140,"tactic":141},"D3-SBV","Service Binary Verification",{"name":44},{"id":143,"name":144,"tactics":145,"countermeasures":151},"T1574.010","Services File Permissions Weakness",[146,147,148,149,150],{"id":29,"name":30},{"id":32,"name":33},{"id":112,"name":113},{"id":115,"name":116},{"id":118,"name":119},[152,154,156,158,160],{"id":126,"name":127,"tactic":153},{"name":100},{"id":135,"name":136,"tactic":155},{"name":133},{"id":139,"name":140,"tactic":157},{"name":44},{"id":130,"name":131,"tactic":159},{"name":133},{"id":122,"name":123,"tactic":161},{"name":79},{"id":163,"name":164,"techniques":165},"CAPEC-35","Leverage Executable Code in Non-Executable Files",[166,173,180],{"id":167,"name":168,"tactics":169,"countermeasures":172},"T1027.006","HTML Smuggling",[170,171],{"id":112,"name":113},{"id":115,"name":116},[],{"id":174,"name":175,"tactics":176,"countermeasures":179},"T1027.009","Embedded Payloads",[177,178],{"id":112,"name":113},{"id":115,"name":116},[],{"id":181,"name":182,"tactics":183,"countermeasures":186},"T1564.009","Resource Forking",[184,185],{"id":112,"name":113},{"id":115,"name":116},[187],{"id":188,"name":189,"tactic":190},"D3-FFV","File Format Verification",{"name":39},{"id":192,"name":193,"techniques":194},"CAPEC-76","Manipulating Web Input to File System Calls",[],{"_key":196,"id":196,"name":197,"description":198,"type":15,"status":199,"abstraction":200,"likelihood_of_exploit":9,"capec":201},"CWE-284","Improper Access Control","The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.","Incomplete","Pillar",[202,251,255,302,315,319,323,327,331,374,413,515,532,627,647,651,811],{"id":203,"name":204,"techniques":205},"CAPEC-19","Embedding Scripts within Scripts",[206,211,244],{"id":174,"name":175,"tactics":207,"countermeasures":210},[208,209],{"id":112,"name":113},{"id":115,"name":116},[],{"id":212,"name":213,"tactics":214,"countermeasures":217},"T1546.004","Unix Shell Configuration Modification",[215,216],{"id":32,"name":33},{"id":29,"name":30},[218,220,222,224,226,228,230,232,234,238,240,242],{"id":68,"name":69,"tactic":219},{"name":44},{"id":89,"name":90,"tactic":221},{"name":39},{"id":93,"name":94,"tactic":223},{"name":39},{"id":63,"name":64,"tactic":225},{"name":66},{"id":76,"name":77,"tactic":227},{"name":79},{"id":46,"name":47,"tactic":229},{"name":44},{"id":58,"name":59,"tactic":231},{"name":61},{"id":54,"name":55,"tactic":233},{"name":39},{"id":235,"name":236,"tactic":237},"D3-USICA","User Session Init Config Analysis",{"name":44},{"id":72,"name":73,"tactic":239},{"name":39},{"id":36,"name":37,"tactic":241},{"name":39},{"id":97,"name":98,"tactic":243},{"name":100},{"id":245,"name":246,"tactics":247,"countermeasures":250},"T1546.016","Installer Packages",[248,249],{"id":32,"name":33},{"id":29,"name":30},[],{"id":252,"name":253,"techniques":254},"CAPEC-441","Malicious Logic Insertion",[],{"id":256,"name":257,"techniques":258},"CAPEC-478","Modification of Windows Service Configuration",[259,283],{"id":260,"name":261,"tactics":262,"countermeasures":268},"T1574.011","Services Registry Permissions Weakness",[263,264,265,266,267],{"id":29,"name":30},{"id":32,"name":33},{"id":112,"name":113},{"id":115,"name":116},{"id":118,"name":119},[269,273,275,279],{"id":270,"name":271,"tactic":272},"D3-SICA","System Init Config Analysis",{"name":44},{"id":93,"name":94,"tactic":274},{"name":39},{"id":276,"name":277,"tactic":278},"D3-RC","Restore Configuration",{"name":100},{"id":280,"name":281,"tactic":282},"D3-CI","Configuration Inventory",{"name":133},{"id":284,"name":285,"tactics":286,"countermeasures":289},"T1543.003","Windows Service",[287,288],{"id":29,"name":30},{"id":32,"name":33},[290,294,298],{"id":291,"name":292,"tactic":293},"D3-DI","Data Inventory",{"name":133},{"id":295,"name":296,"tactic":297},"D3-SCP","System Configuration Permissions",{"name":79},{"id":299,"name":300,"tactic":301},"D3-RD","Restore Database",{"name":100},{"id":303,"name":304,"techniques":305},"CAPEC-479","Malicious Root Certificate",[306],{"id":307,"name":308,"tactics":309,"countermeasures":314},"T1553.004","Install Root Certificate",[310,311],{"id":112,"name":113},{"id":312,"name":313},"TA0112","Defense Impairment",[],{"id":316,"name":317,"techniques":318},"CAPEC-502","Intent Spoof",[],{"id":320,"name":321,"techniques":322},"CAPEC-503","WebView Exposure",[],{"id":324,"name":325,"techniques":326},"CAPEC-536","Data Injected During Configuration",[],{"id":328,"name":329,"techniques":330},"CAPEC-546","Incomplete Data Deletion in a Multi-Tenant Environment",[],{"id":332,"name":333,"techniques":334},"CAPEC-550","Install New Service",[335],{"id":336,"name":337,"tactics":338,"countermeasures":341},"T1543","Create or Modify System Process",[339,340],{"id":29,"name":30},{"id":32,"name":33},[342,344,346,348,350,352,354,356,358,360,364,366,368,370,372],{"id":72,"name":73,"tactic":343},{"name":39},{"id":58,"name":59,"tactic":345},{"name":61},{"id":68,"name":69,"tactic":347},{"name":44},{"id":46,"name":47,"tactic":349},{"name":44},{"id":97,"name":98,"tactic":351},{"name":100},{"id":36,"name":37,"tactic":353},{"name":39},{"id":89,"name":90,"tactic":355},{"name":39},{"id":93,"name":94,"tactic":357},{"name":39},{"id":54,"name":55,"tactic":359},{"name":39},{"id":361,"name":362,"tactic":363},"D3-SFA","System File Analysis",{"name":44},{"id":291,"name":292,"tactic":365},{"name":133},{"id":63,"name":64,"tactic":367},{"name":66},{"id":76,"name":77,"tactic":369},{"name":79},{"id":299,"name":300,"tactic":371},{"name":100},{"id":295,"name":296,"tactic":373},{"name":79},{"id":375,"name":376,"techniques":377},"CAPEC-551","Modify Existing Service",[378],{"id":336,"name":337,"tactics":379,"countermeasures":382},[380,381],{"id":29,"name":30},{"id":32,"name":33},[383,385,387,389,391,393,395,397,399,401,403,405,407,409,411],{"id":72,"name":73,"tactic":384},{"name":39},{"id":58,"name":59,"tactic":386},{"name":61},{"id":68,"name":69,"tactic":388},{"name":44},{"id":46,"name":47,"tactic":390},{"name":44},{"id":97,"name":98,"tactic":392},{"name":100},{"id":36,"name":37,"tactic":394},{"name":39},{"id":89,"name":90,"tactic":396},{"name":39},{"id":93,"name":94,"tactic":398},{"name":39},{"id":54,"name":55,"tactic":400},{"name":39},{"id":361,"name":362,"tactic":402},{"name":44},{"id":291,"name":292,"tactic":404},{"name":133},{"id":63,"name":64,"tactic":406},{"name":66},{"id":76,"name":77,"tactic":408},{"name":79},{"id":299,"name":300,"tactic":410},{"name":100},{"id":295,"name":296,"tactic":412},{"name":79},{"id":414,"name":415,"techniques":416},"CAPEC-552","Install Rootkit ",[417,466,486],{"id":418,"name":419,"tactics":420,"countermeasures":423},"T1014","Rootkit",[421,422],{"id":112,"name":113},{"id":115,"name":116},[424,426,428,430,432,434,436,438,440,442,444,446,448,452,454,458,462,464],{"id":130,"name":131,"tactic":425},{"name":133},{"id":135,"name":136,"tactic":427},{"name":133},{"id":54,"name":55,"tactic":429},{"name":39},{"id":122,"name":123,"tactic":431},{"name":79},{"id":72,"name":73,"tactic":433},{"name":39},{"id":36,"name":37,"tactic":435},{"name":39},{"id":97,"name":98,"tactic":437},{"name":100},{"id":89,"name":90,"tactic":439},{"name":39},{"id":68,"name":69,"tactic":441},{"name":44},{"id":46,"name":47,"tactic":443},{"name":44},{"id":63,"name":64,"tactic":445},{"name":66},{"id":126,"name":127,"tactic":447},{"name":100},{"id":449,"name":450,"tactic":451},"D3-FEMC","Firmware Embedded Monitoring Code",{"name":44},{"id":76,"name":77,"tactic":453},{"name":79},{"id":455,"name":456,"tactic":457},"D3-FV","Firmware Verification",{"name":44},{"id":459,"name":460,"tactic":461},"D3-FBA","Firmware Behavior Analysis",{"name":44},{"id":58,"name":59,"tactic":463},{"name":61},{"id":93,"name":94,"tactic":465},{"name":39},{"id":467,"name":468,"tactics":469,"countermeasures":473},"T1542.003","Bootkit",[470,471,472],{"id":112,"name":113},{"id":115,"name":116},{"id":29,"name":30},[474,478,480,482,484],{"id":475,"name":476,"tactic":477},"D3-BA","Bootloader Authentication",{"name":79},{"id":130,"name":131,"tactic":479},{"name":133},{"id":122,"name":123,"tactic":481},{"name":79},{"id":126,"name":127,"tactic":483},{"name":100},{"id":135,"name":136,"tactic":485},{"name":133},{"id":487,"name":488,"tactics":489,"countermeasures":492},"T1547.006","Kernel Modules and Extensions",[490,491],{"id":29,"name":30},{"id":32,"name":33},[493,495,497,499,501,503,505,507,509,511,513],{"id":76,"name":77,"tactic":494},{"name":79},{"id":46,"name":47,"tactic":496},{"name":44},{"id":63,"name":64,"tactic":498},{"name":66},{"id":58,"name":59,"tactic":500},{"name":61},{"id":72,"name":73,"tactic":502},{"name":39},{"id":36,"name":37,"tactic":504},{"name":39},{"id":89,"name":90,"tactic":506},{"name":39},{"id":93,"name":94,"tactic":508},{"name":39},{"id":54,"name":55,"tactic":510},{"name":39},{"id":97,"name":98,"tactic":512},{"name":100},{"id":68,"name":69,"tactic":514},{"name":44},{"id":516,"name":517,"techniques":518},"CAPEC-556","Replace File Extension Handlers",[519],{"id":520,"name":521,"tactics":522,"countermeasures":525},"T1546.001","Change Default File Association",[523,524],{"id":32,"name":33},{"id":29,"name":30},[526,528,530],{"id":93,"name":94,"tactic":527},{"name":39},{"id":276,"name":277,"tactic":529},{"name":100},{"id":280,"name":281,"tactic":531},{"name":133},{"id":533,"name":534,"techniques":535},"CAPEC-558","Replace Trusted Executable",[536,542],{"id":537,"name":538,"tactics":539,"countermeasures":541},"T1505.005","Terminal Services DLL",[540],{"id":29,"name":30},[],{"id":543,"name":544,"tactics":545,"countermeasures":548},"T1546.008","Accessibility Features",[546,547],{"id":32,"name":33},{"id":29,"name":30},[549,551,555,559,561,565,567,571,573,577,581,583,585,587,589,591,595,599,601,603,605,607,609,611,613,615,619,623],{"id":58,"name":59,"tactic":550},{"name":61},{"id":552,"name":553,"tactic":554},"D3-APCA","Application Protocol Command Analysis",{"name":44},{"id":556,"name":557,"tactic":558},"D3-NTCD","Network Traffic Community Deviation",{"name":44},{"id":63,"name":64,"tactic":560},{"name":66},{"id":562,"name":563,"tactic":564},"D3-RTSD","Remote Terminal Session Detection",{"name":44},{"id":76,"name":77,"tactic":566},{"name":79},{"id":568,"name":569,"tactic":570},"D3-CAA","Connection Attempt Analysis",{"name":44},{"id":68,"name":69,"tactic":572},{"name":44},{"id":574,"name":575,"tactic":576},"D3-CSPP","Client-server Payload Profiling",{"name":44},{"id":578,"name":579,"tactic":580},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":44},{"id":46,"name":47,"tactic":582},{"name":44},{"id":41,"name":42,"tactic":584},{"name":44},{"id":97,"name":98,"tactic":586},{"name":100},{"id":50,"name":51,"tactic":588},{"name":44},{"id":276,"name":277,"tactic":590},{"name":100},{"id":592,"name":593,"tactic":594},"D3-NTSA","Network Traffic Signature Analysis",{"name":44},{"id":596,"name":597,"tactic":598},"D3-ANAA","Administrative Network Activity Analysis",{"name":44},{"id":72,"name":73,"tactic":600},{"name":39},{"id":36,"name":37,"tactic":602},{"name":39},{"id":89,"name":90,"tactic":604},{"name":39},{"id":93,"name":94,"tactic":606},{"name":39},{"id":54,"name":55,"tactic":608},{"name":39},{"id":81,"name":82,"tactic":610},{"name":39},{"id":85,"name":86,"tactic":612},{"name":39},{"id":280,"name":281,"tactic":614},{"name":133},{"id":616,"name":617,"tactic":618},"D3-NTF","Network Traffic Filtering",{"name":39},{"id":620,"name":621,"tactic":622},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":44},{"id":624,"name":625,"tactic":626},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":44},{"id":628,"name":629,"techniques":630},"CAPEC-562","Modify Shared File",[631],{"id":632,"name":633,"tactics":634,"countermeasures":638},"T1080","Taint Shared Content",[635],{"id":636,"name":637},"TA0109","Lateral Movement",[639,643],{"id":640,"name":641,"tactic":642},"D3-NRAM","Network Resource Access Mediation",{"name":39},{"id":644,"name":645,"tactic":646},"D3-DNR","Decoy Network Resource",{"name":66},{"id":648,"name":649,"techniques":650},"CAPEC-563","Add Malicious File to Shared Webroot",[],{"id":652,"name":653,"techniques":654},"CAPEC-564","Run Software at Logon",[655,702,731,760],{"id":656,"name":657,"tactics":658,"countermeasures":661},"T1037","Boot or Logon Initialization Scripts",[659,660],{"id":29,"name":30},{"id":32,"name":33},[662,664,666,668,670,672,674,676,678,680,682,684,686,688,690,692,694,696,698,700],{"id":72,"name":73,"tactic":663},{"name":39},{"id":280,"name":281,"tactic":665},{"name":133},{"id":76,"name":77,"tactic":667},{"name":79},{"id":97,"name":98,"tactic":669},{"name":100},{"id":276,"name":277,"tactic":671},{"name":100},{"id":36,"name":37,"tactic":673},{"name":39},{"id":89,"name":90,"tactic":675},{"name":39},{"id":93,"name":94,"tactic":677},{"name":39},{"id":54,"name":55,"tactic":679},{"name":39},{"id":81,"name":82,"tactic":681},{"name":39},{"id":85,"name":86,"tactic":683},{"name":39},{"id":58,"name":59,"tactic":685},{"name":61},{"id":68,"name":69,"tactic":687},{"name":44},{"id":46,"name":47,"tactic":689},{"name":44},{"id":41,"name":42,"tactic":691},{"name":44},{"id":50,"name":51,"tactic":693},{"name":44},{"id":644,"name":645,"tactic":695},{"name":66},{"id":640,"name":641,"tactic":697},{"name":39},{"id":270,"name":271,"tactic":699},{"name":44},{"id":63,"name":64,"tactic":701},{"name":66},{"id":703,"name":704,"tactics":705,"countermeasures":708},"T1543.001","Launch Agent",[706,707],{"id":29,"name":30},{"id":32,"name":33},[709,711,713,715,717,719,721,723,725,727,729],{"id":72,"name":73,"tactic":710},{"name":39},{"id":89,"name":90,"tactic":712},{"name":39},{"id":46,"name":47,"tactic":714},{"name":44},{"id":76,"name":77,"tactic":716},{"name":79},{"id":54,"name":55,"tactic":718},{"name":39},{"id":97,"name":98,"tactic":720},{"name":100},{"id":36,"name":37,"tactic":722},{"name":39},{"id":93,"name":94,"tactic":724},{"name":39},{"id":63,"name":64,"tactic":726},{"name":66},{"id":68,"name":69,"tactic":728},{"name":44},{"id":58,"name":59,"tactic":730},{"name":61},{"id":732,"name":733,"tactics":734,"countermeasures":737},"T1543.004","Launch Daemon",[735,736],{"id":29,"name":30},{"id":32,"name":33},[738,740,742,744,746,748,750,752,754,756,758],{"id":93,"name":94,"tactic":739},{"name":39},{"id":54,"name":55,"tactic":741},{"name":39},{"id":63,"name":64,"tactic":743},{"name":66},{"id":68,"name":69,"tactic":745},{"name":44},{"id":46,"name":47,"tactic":747},{"name":44},{"id":58,"name":59,"tactic":749},{"name":61},{"id":97,"name":98,"tactic":751},{"name":100},{"id":72,"name":73,"tactic":753},{"name":39},{"id":36,"name":37,"tactic":755},{"name":39},{"id":89,"name":90,"tactic":757},{"name":39},{"id":76,"name":77,"tactic":759},{"name":79},{"id":761,"name":762,"tactics":763,"countermeasures":766},"T1547","Boot or Logon Autostart Execution",[764,765],{"id":29,"name":30},{"id":32,"name":33},[767,769,771,773,775,777,779,781,783,785,787,789,791,793,795,797,799,801,803,805,807,809],{"id":89,"name":90,"tactic":768},{"name":39},{"id":76,"name":77,"tactic":770},{"name":79},{"id":68,"name":69,"tactic":772},{"name":44},{"id":46,"name":47,"tactic":774},{"name":44},{"id":122,"name":123,"tactic":776},{"name":79},{"id":270,"name":271,"tactic":778},{"name":44},{"id":280,"name":281,"tactic":780},{"name":133},{"id":135,"name":136,"tactic":782},{"name":133},{"id":97,"name":98,"tactic":784},{"name":100},{"id":130,"name":131,"tactic":786},{"name":133},{"id":276,"name":277,"tactic":788},{"name":100},{"id":126,"name":127,"tactic":790},{"name":100},{"id":41,"name":42,"tactic":792},{"name":44},{"id":50,"name":51,"tactic":794},{"name":44},{"id":72,"name":73,"tactic":796},{"name":39},{"id":36,"name":37,"tactic":798},{"name":39},{"id":93,"name":94,"tactic":800},{"name":39},{"id":54,"name":55,"tactic":802},{"name":39},{"id":58,"name":59,"tactic":804},{"name":61},{"id":81,"name":82,"tactic":806},{"name":39},{"id":85,"name":86,"tactic":808},{"name":39},{"id":63,"name":64,"tactic":810},{"name":66},{"id":812,"name":813,"techniques":814},"CAPEC-578","Disable Security Software",[815,874,907,926,937,948,959],{"id":816,"name":817,"tactics":818,"countermeasures":825},"T1556.006","Multi-Factor Authentication",[819,820,821,822],{"id":112,"name":113},{"id":312,"name":313},{"id":29,"name":30},{"id":823,"name":824},"TA0031","Credential Access",[826,830,834,838,842,846,850,854,858,862,866,870],{"id":827,"name":828,"tactic":829},"D3-ABPI","Application-based Process Isolation",{"name":39},{"id":831,"name":832,"tactic":833},"D3-PS","Process Suspension",{"name":61},{"id":835,"name":836,"tactic":837},"D3-HBPI","Hardware-based Process Isolation",{"name":39},{"id":839,"name":840,"tactic":841},"D3-WSAM","Web Session Access Mediation",{"name":39},{"id":843,"name":844,"tactic":845},"D3-PSA","Process Spawn Analysis",{"name":44},{"id":847,"name":848,"tactic":849},"D3-PT","Process Termination",{"name":61},{"id":851,"name":852,"tactic":853},"D3-HR","Host Reboot",{"name":61},{"id":855,"name":856,"tactic":857},"D3-PLA","Process Lineage Analysis",{"name":44},{"id":859,"name":860,"tactic":861},"D3-PSMD","Process Self-Modification Detection",{"name":44},{"id":863,"name":864,"tactic":865},"D3-KBPI","Kernel-based Process Isolation",{"name":39},{"id":867,"name":868,"tactic":869},"D3-HS","Host Shutdown",{"name":61},{"id":871,"name":872,"tactic":873},"D3-SCF","System Call Filtering",{"name":39},{"id":875,"name":876,"tactics":877,"countermeasures":880},"T1562.001","Disable or Modify Tools",[878,879],{"id":112,"name":113},{"id":115,"name":116},[881,883,885,887,891,893,895,897,899,901,903,905],{"id":827,"name":828,"tactic":882},{"name":39},{"id":859,"name":860,"tactic":884},{"name":44},{"id":843,"name":844,"tactic":886},{"name":44},{"id":888,"name":889,"tactic":890},"D3-SDM","System Daemon Monitoring",{"name":44},{"id":863,"name":864,"tactic":892},{"name":39},{"id":871,"name":872,"tactic":894},{"name":39},{"id":835,"name":836,"tactic":896},{"name":39},{"id":851,"name":852,"tactic":898},{"name":61},{"id":867,"name":868,"tactic":900},{"name":61},{"id":847,"name":848,"tactic":902},{"name":61},{"id":831,"name":832,"tactic":904},{"name":61},{"id":855,"name":856,"tactic":906},{"name":44},{"id":908,"name":909,"tactics":910,"countermeasures":913},"T1562.002","Disable Windows Event Logging",[911,912],{"id":112,"name":113},{"id":115,"name":116},[914,918,920,924],{"id":915,"name":916,"tactic":917},"D3-ACH","Application Configuration Hardening",{"name":79},{"id":280,"name":281,"tactic":919},{"name":133},{"id":921,"name":922,"tactic":923},"D3-DRA","Disable Remote Access",{"name":79},{"id":276,"name":277,"tactic":925},{"name":100},{"id":927,"name":928,"tactics":929,"countermeasures":932},"T1562.004","Disable or Modify System Firewall",[930,931],{"id":112,"name":113},{"id":115,"name":116},[933,935],{"id":280,"name":281,"tactic":934},{"name":133},{"id":276,"name":277,"tactic":936},{"name":100},{"id":938,"name":939,"tactics":940,"countermeasures":943},"T1562.007","Disable or Modify Cloud Firewall",[941,942],{"id":112,"name":113},{"id":115,"name":116},[944,946],{"id":280,"name":281,"tactic":945},{"name":133},{"id":276,"name":277,"tactic":947},{"name":100},{"id":949,"name":950,"tactics":951,"countermeasures":954},"T1562.008","Disable or Modify Cloud Logs",[952,953],{"id":112,"name":113},{"id":115,"name":116},[955,957],{"id":280,"name":281,"tactic":956},{"name":133},{"id":276,"name":277,"tactic":958},{"name":100},{"id":960,"name":961,"tactics":962,"countermeasures":965},"T1562.009","Safe Mode Boot",[963,964],{"id":112,"name":113},{"id":115,"name":116},[966,968,970,972],{"id":93,"name":94,"tactic":967},{"name":39},{"id":276,"name":277,"tactic":969},{"name":100},{"id":270,"name":271,"tactic":971},{"name":44},{"id":280,"name":281,"tactic":973},{"name":133},[],[],[],[],[],[],"2026-09-08T17:19:13.121Z","2026-09-09T04:25:46.635Z","Analyzed",{"cisa_kev":984,"cisa_ransomware":985,"cisa_vendor":986,"epss_severity":9,"epss_score":9,"severity":987,"severity_score":988,"severity_version":989,"severity_source":990,"severity_vector":991,"severity_status":982},true,false,"Microsoft","high",7.8,"v3.1","cve.org","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",[993,1000],{"url":994,"sources":995,"tags":997},"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963",[990,996],"nvd",[998,999],"Vendor Advisory","Patch",{"url":1001,"sources":1002,"tags":1003},"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963",[990,996],[1004,1005],"Government Resource","US Government Resource",[1007],{"source":1008,"vendor":986,"product":1009,"date_added":1010,"vulnerability_name":1011,"short_description":1012,"required_action":1013,"due_date":1014,"known_ransomware_campaign_use":1015,"notes":1016,"exploitation_type":9},"cisa","Windows","2026-09-08","Microsoft Windows Link Following Vulnerability","Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","2026-09-22","Unknown","https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-81963",[],[1019,1024],{"source":990,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":1020,"cvss_v4_0":9},{"baseScore":988,"baseSeverity":1021,"vectorString":991,"impactScore":1022,"exploitabilityScore":1023},"HIGH",9.8,4.6,{"source":996,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":1025,"cvss_v4_0":9},{"baseScore":988,"baseSeverity":1021,"vectorString":1026,"impactScore":1022,"exploitabilityScore":1023},"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",[1028,1039,1046,1053,1060,1069,1076,1083,1090,1099],{"ecosystem":9,"name":1029,"vendor":1030,"product":1031,"cpe_part":1032,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":1033},"windows 11 23h2","microsoft","windows_11_23h2","o",[1034],{"version":1035,"is_range":984,"range_type":1036,"version_start":9,"version_start_type":9,"version_end":1037,"version_end_type":1038,"fixed_in":9},"lt10.0.22631.7582","cpe","10.0.22631.7582","excluding",{"ecosystem":9,"name":1040,"vendor":1030,"product":1041,"cpe_part":1032,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":1042},"windows 11 24h2","windows_11_24h2",[1043],{"version":1044,"is_range":984,"range_type":1036,"version_start":9,"version_start_type":9,"version_end":1045,"version_end_type":1038,"fixed_in":9},"lt10.0.26100.9445","10.0.26100.9445",{"ecosystem":9,"name":1047,"vendor":1030,"product":1048,"cpe_part":1032,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":1049},"windows 11 25h2","windows_11_25h2",[1050],{"version":1051,"is_range":984,"range_type":1036,"version_start":9,"version_start_type":9,"version_end":1052,"version_end_type":1038,"fixed_in":9},"lt10.0.26200.9445","10.0.26200.9445",{"ecosystem":9,"name":1054,"vendor":1030,"product":1055,"cpe_part":1032,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":1056},"windows 11 26h1","windows_11_26h1",[1057],{"version":1058,"is_range":984,"range_type":1036,"version_start":9,"version_start_type":9,"version_end":1059,"version_end_type":1038,"fixed_in":9},"lt10.0.28000.2954","10.0.28000.2954",{"ecosystem":9,"name":1061,"vendor":1030,"product":1062,"cpe_part":1063,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":1064},"Windows 11 version 23H2","windows 11 version 23h2","a",[1065],{"version":1066,"is_range":984,"range_type":990,"version_start":1067,"version_start_type":1068,"version_end":1037,"version_end_type":1038,"fixed_in":9},">= 10.0.22631.0, \u003C 10.0.22631.7582","10.0.22631.0","including",{"ecosystem":9,"name":1070,"vendor":1030,"product":1071,"cpe_part":1063,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":1072},"Windows 11 Version 24H2","windows 11 version 24h2",[1073],{"version":1074,"is_range":984,"range_type":990,"version_start":1075,"version_start_type":1068,"version_end":1045,"version_end_type":1038,"fixed_in":9},">= 10.0.26100.0, \u003C 10.0.26100.9445","10.0.26100.0",{"ecosystem":9,"name":1077,"vendor":1030,"product":1078,"cpe_part":1063,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":1079},"Windows 11 Version 25H2","windows 11 version 25h2",[1080],{"version":1081,"is_range":984,"range_type":990,"version_start":1082,"version_start_type":1068,"version_end":1052,"version_end_type":1038,"fixed_in":9},">= 10.0.26200.0, \u003C 10.0.26200.9445","10.0.26200.0",{"ecosystem":9,"name":1084,"vendor":1030,"product":1085,"cpe_part":1063,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":1086},"Windows 11 version 26H1","windows 11 version 26h1",[1087],{"version":1088,"is_range":984,"range_type":990,"version_start":1089,"version_start_type":1068,"version_end":1059,"version_end_type":1038,"fixed_in":9},">= 10.0.28000.0, \u003C 10.0.28000.2954","10.0.28000.0",{"ecosystem":9,"name":1091,"vendor":1030,"product":1092,"cpe_part":1063,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":1093},"Windows Server 2025","windows server 2025",[1094,1097],{"version":1095,"is_range":984,"range_type":990,"version_start":1075,"version_start_type":1068,"version_end":1096,"version_end_type":1038,"fixed_in":9},">= 10.0.26100.0, \u003C 10.0.26100.33438","10.0.26100.33438",{"version":1098,"is_range":984,"range_type":1036,"version_start":9,"version_start_type":9,"version_end":1096,"version_end_type":1038,"fixed_in":9},"lt10.0.26100.33438",{"ecosystem":9,"name":1100,"vendor":1030,"product":1101,"cpe_part":1063,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":1102},"Windows Server 2025 (Server Core installation)","windows server 2025 (server core installation)",[1103],{"version":1095,"is_range":984,"range_type":990,"version_start":1075,"version_start_type":1068,"version_end":1096,"version_end_type":1038,"fixed_in":9}]