How do you patch or mitigate CVE-2026-81963 (Microsoft Windows Link Following)?

CISA’s required action for CVE-2026-81963 is to apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

What patching means for a link-following Windows flaw

For a Windows link-following vulnerability, the first question is whether the affected systems can be reached by untrusted input, shortcuts, links, archives, or other file-handling paths that may trigger the bug. Because the direct answer already points you to vendor instructions and CISA’s risk-based update guidance, the practical task is to confirm exposure, then apply the vendor fix or mitigation that specifically blocks the unsafe link resolution path.

When immediate patching is not possible, treat the issue as a control problem, not just a maintenance delay. Restrict the systems and user workflows that can trigger link traversal, reduce exposure to untrusted files, and follow the vendor’s stated workaround exactly rather than improvising a substitute. For current exploitation triage, use the CISA Known Exploited Vulnerabilities Catalog alongside the vendor advisory.

How to confirm exposure and reduce blast radius

Start by locating the Windows versions, roles, and user paths that actually process the vulnerable link type. A workstation used for routine browsing, a file server, and a jump host do not carry the same exposure profile, even if they run the same operating system. The operational question is whether the vulnerable behavior is reachable from untrusted content in that environment.

Then narrow the blast radius. Where the product is internet-facing or exposed to higher-risk content sources, prioritize those assets first under CISA’s risk-based update guidance. Where patching or mitigation is deferred, isolate the system from untrusted link inputs, constrain file exchange paths, and document the exception so the residual risk is explicit and time-bounded.

For vulnerability triage and remediation sequencing, the NIST Cybersecurity Framework 2.0 and NIST AI Risk Management Framework are not the right depth for this specific flaw, but the FIRST EPSS model can still help you place the vulnerability in a broader prioritization queue when you are comparing many items at once.

What to do if you cannot patch yet

If you cannot apply the vendor fix immediately, focus on compensating controls that reduce exploitability rather than pretending the issue is gone. That usually means blocking untrusted file sources, tightening endpoint and gateway handling for link-bearing content, and minimizing who can interact with the affected host until remediation is complete. Where CISA says to discontinue use of the product if mitigations are unavailable, treat that as the decision point, not as a last resort to ignore.

After mitigation or patching, verify that the system no longer follows the unsafe link path and that no malicious file, shortcut, or staged payload was used to trigger the flaw before the fix. The CVE Program provides the record context, while the NIST National Vulnerability Database is useful for confirming the canonical CVE entry and matching it to your inventory.

Risk and Threat Considerations

Link-following flaws are dangerous because they often turn ordinary file handling into unintended file access or execution paths. That can expose local data, enable malicious content to be opened in the wrong context, or support lateral movement if an attacker can combine the flaw with a phishing or staging technique.

Failure mechanism: A crafted shortcut, link, or related file object triggers Windows to resolve a target the user or application did not intend to trust, allowing the attacker to abuse normal file navigation behavior as an execution or access path.

Impact: The practical impact can range from user compromise and data exposure to deeper endpoint compromise, especially where the vulnerable system handles untrusted content at scale or has access to sensitive files and credentials.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	This CVE requires exposure confirmation, prioritization, and remediation tracking.
Recommendation — Prioritize, patch, and verify remediation for exposed Windows assets.
NIST CSF 2.0	ID.RA-01 — Asset vulnerabilities are identified and documented	Patch decisions depend on identifying where the vulnerable Windows path exists.
Recommendation — Identify affected assets and record the vulnerable exposure path.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The issue is remediated by applying vendor fixes or approved mitigations.
	RA-5 — Vulnerability Monitoring and Scanning	Exposure confirmation and exception handling rely on continuous vulnerability discovery.
Recommendation — Apply vendor fixes or approved mitigations and verify they remain effective. Scan for exposed systems and track remediation exceptions until closed.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	This is a technical vulnerability that needs governed remediation and exception handling.
Recommendation — Manage the flaw through controlled remediation, validation, and exception review.

Practitioner Guidance

What to verify: Confirm that you know which Windows assets can actually encounter the vulnerable link type, not just which assets are installed. The right remediation order is driven by reachability and exposure, especially for internet-facing or high-trust endpoints.

Decision rule: If the vendor mitigation fully blocks the unsafe behavior, apply it first and verify functionality afterward. If no effective mitigation exists, treat continued use as a temporary exception only if the business owner accepts the exposure and you have a firm remediation date.

Practitioner takeaway: For a link-following Windows CVE, the real control question is whether untrusted file paths can still reach the vulnerable behavior, because that determines whether patching is urgent, compensating controls are enough, or the system must be taken out of service.