CVE-2026-85884
Windows Health and Optimized Experiences Service elevation of privilege
Microsoft scores CVE-2026-85884 CVSS 3.1 7.8 (Important). A missing authentication check in the Windows Health and Optimized Experiences Service lets an authorized local attacker gain higher privileges on Windows 11 24H2, 25H2, 26H1 and 26H2. Fixed in the 13 October 2026 updates. Third-party PoC claimed. Not in CISA KEV.
- CVSS
- 7.8
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Class
- LPE
- Status
- PoC Available
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Microsoft
- Products
- Windows 11 24H2, Windows 11 25H2, Windows 11 26H1, Windows 11 26H2
- Affected
- Windows 11 24H2 before build 10.0.26100.9711, 25H2 before 10.0.26200.9711, 26H1 before 10.0.28000.3231 and 26H2 before 10.0.26300.9711, on x64 and ARM64.
- Fixed
- October 2026 cumulative updates: KB5127648 for 24H2, 25H2 and 26H2, and KB5127646 for 26H1, released 13 October 2026.
- CWE
- CWE-306
- Published
- 13 Oct 2026
- Updated
- 15 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-85884 is a missing authentication flaw (CWE-306) in the Windows Health and Optimized Experiences Service. It affects Windows 11 24H2, 25H2, 26H1 and 26H2.
Microsoft released the fix on 13 October 2026. It scores the flaw CVSS 3.1 7.8 and rates it Important. NVD shows the Microsoft score and is still analyzing the record.
An authorized local attacker can elevate privileges. Microsoft does not say to which level. The attacker needs a local account. It is not a remote flaw.
Microsoft lists its exploitability as "Exploitation More Likely". It marks the flaw as not publicly disclosed and not exploited at release.
Microsoft credits eight finder groups. The first listed is Alexander Hagenah (@xaitax). The CVE is not in the CISA KEV catalog.
A GitHub account named Beardhammer published a repository on 13 October 2026. Its name, description and README claim a PoC for this CVE. The account is not among the people credited by Microsoft. ThreatWire did not run or verify it. The PoC link field points to it; the URL is not repeated here.