Windows Update Stack: link following lets a local user escalate to SYSTEM

Impact

The update servicing stack resolves a path without checking that it is not a symlink or junction the caller controls, so an authorized local user can redirect a privileged file operation and elevate. On a Windows Server 2025 node - including Server Core - that turns any local account or service identity into full control of the host. This matters on the Windows side of a GPU estate: management jump hosts, license servers, and Windows Server 2025 hosts running GPU workloads or Hyper-V. CISA lists it as exploited in the wild, which moves it from a routine Patch Tuesday elevation to something worth a near-term window. Windows 11 23H2 through 26H1 are also listed, but those are client SKUs outside this database's scope.

Who can reach it

A local, already-authenticated user or a compromised low-privilege service on an affected Windows host. No user interaction. Not reachable over the network on its own - it is the second stage after any initial foothold.

What to do

Install the September 2026 cumulative update for the affected SKU; the MSRC entry carries the per-SKU KB numbers. Windows servicing-stack patches require a reboot, so plan a per-node window and drain or fail over the host first. Microsoft publishes no mitigation short of the update, and because the flaw is exploited in the wild there is no useful "wait for the next window" position on internet-adjacent or multi-admin hosts.

References

Related entries

• Windows ALPC: heap overflow gives a local user privilege escalation to SYSTEMCVE-2026-85880 · Windows ALPC (Advanced Local Procedure Call)High
• Linux kernel sunrpc: use-gss-proxy proc entry published before its mutex is initializedCVE-2026-89540 · Linux kernel sunrpc/auth_rpcgss (use-gss-proxy procfs entry, gssp_lock init ordering)High
• Linux kernel nfsd: use-after-free reading NFSv4 compound ops from the rpc_status netlink dumpCVE-2026-89690 · Linux kernel nfsd (nfsd4_release_compoundargs / rpc_status netlink dump)High
• Linux kernel mm/pagewalk: stale ACTION_AGAIN causes duplicate walk callbacks and an out-of-bounds write via mincore()CVE-2026-89754 · Linux kernel mm/pagewalk (walk_pmd_range stale walk->action)High
• Linux kernel mm/migrate_device: stale swapcache mapping after folio_free_swap() corrupts folio refcountsCVE-2026-89755 · Linux kernel mm/migrate_device (__migrate_device_pages stale swapcache mapping)High
• Linux kernel mm/mempolicy: device-private PMD from GPU THP migration decoded as a PFN, yielding a bogus folioCVE-2026-89758 · Linux kernel mm/mempolicy (queue_folios_pmd, device-private PMD handling)High