Windows 11 Health Service flaw CVE-2026-85884 allows local privilege escalation
Microsoft fixed CVE-2026-85884 on 13 October 2026. A missing authentication check in the Windows Health and Optimized Experiences Service lets a local attacker gain privileges on Windows 11. CVSS 3.1 7.8 (Important, scored by Microsoft). Third-party PoC claimed. Not in CISA KEV.
Published 15 Oct 2026
What happened
Microsoft fixed CVE-2026-85884 in its 13 October 2026 Patch Tuesday release. The flaw is in the Windows Health and Optimized Experiences Service. Microsoft calls it a missing authentication check for a critical function.
The result is local elevation of privilege. Microsoft credits eight finder groups, led in its list by Alexander Hagenah (@xaitax). ThreatWire did not find a write-up from any of them.
Who is affected
Windows 11 versions 24H2, 25H2, 26H1 and 26H2 are affected, on x64 and ARM64. Fixed builds are 26100.9711, 26200.9711, 28000.3231 and 26300.9711. Earlier builds are exposed.
The attacker needs a local account or a foothold on the machine. Shared workstations, terminal servers and machines where malware has already landed are the main concern.
What is confirmed
Microsoft scores the flaw CVSS 3.1 7.8 and rates it Important. NVD shows the Microsoft score. The weakness is CWE-306.
Microsoft lists exploitability as "Exploitation More Likely". It marks the flaw as not publicly disclosed and not exploited at release. The fixes ship in KB5127648 for 24H2, 25H2 and 26H2, and in KB5127646 for 26H1.
BleepingComputer lists the CVE in its October 2026 Patch Tuesday roundup. Qualys also lists it in its review.
The CVE is not in the CISA KEV catalog. A GitHub account named Beardhammer published a repository on 13 October 2026. Its name, description and README claim a PoC for this CVE. The account dates from 2020 and has a normal mix of repositories. It is not among the credited finders. ThreatWire did not run or verify the PoC.
What is not confirmed
No source reports exploitation in the wild. ThreatWire cannot say whether the PoC works. Microsoft does not state what privilege level an attacker gains.
Neither BleepingComputer nor Qualys gives details beyond the table entry. ThreatWire found no dedicated coverage from an established outlet.
What to do
Install the October 2026 cumulative update for your Windows 11 version and restart. Check the OS build number against the fixed builds above.
Until then, limit local and remote desktop logons to trusted users. Public PoC code can speed up attacks, so prioritize shared and multi-user systems. Treat local privilege escalation as a step in a chain, and patch it with the other October fixes.
Sources: Microsoft MSRC, NVD, CVE.org, BleepingComputer and Qualys. Links are in the references list.