Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-85880

Published 2026-09-08

Updated 23 days ago

Vendor/s

Microsoft

Product/s

Windows

Version/s

\* > 10.0.14393.9512

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

7.8

/ 10

High

Severity Details

Base score

7.8 High

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-85880 is a high-severity heap overflow in Windows ALPC allowing local privilege escalation. Actively exploited; update Windows systems immediately.

## Why this matters

"CVE-2026-85880 is a high-severity (CVSS 7.8) heap-based buffer overflow vulnerability in the Windows Advanced Local Procedure Call (ALPC) mechanism. This flaw is particularly critical because it is actively being exploited in the wild, as confirmed by its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. An authorized attacker with local access can exploit this vulnerability to elevate their privileges to SYSTEM level, effectively gaining full control over the affected machine. Security teams must prioritize this update, especially on multi-user systems and servers where privilege isolation is critical for maintaining a secure environment."

## CPE

Microsoft

| Product               | Version Start | Version End (excl.) | Status     |
| --------------------- | ------------- | ------------------- | ---------- |
| windows\_10\_1607     | \*            | 10.0.14393.9512     | vulnerable |
| windows\_10\_1607     | \*            | 10.0.14393.9512     | vulnerable |
| windows\_10\_1809     | \*            | 10.0.17763.9245     | vulnerable |
| windows\_10\_1809     | \*            | 10.0.17763.9245     | vulnerable |
| windows\_10\_21h2     | \*            | 10.0.19044.7725     | vulnerable |
| windows\_10\_21h2     | \*            | 10.0.19044.7725     | vulnerable |
| windows\_10\_21h2     | \*            | 10.0.19044.7725     | vulnerable |
| windows\_10\_22h2     | \*            | 10.0.19045.7725     | vulnerable |
| windows\_10\_22h2     | \*            | 10.0.19045.7725     | vulnerable |
| windows\_10\_22h2     | \*            | 10.0.19045.7725     | vulnerable |
| windows\_server\_2012 | -             | -                   | vulnerable |
| windows\_server\_2012 | r2            | r2                  | vulnerable |
| windows\_server\_2016 | \*            | 10.0.14393.9512     | vulnerable |
| windows\_server\_2019 | \*            | 10.0.17763.9245     | vulnerable |
| windows\_server\_2022 | \*            | 10.0.20348.5622     | vulnerable |

## Related weakness (CWE)

CWE-122, CWE-908

## Remediation plan

1

### Apply official patches

Microsoft has released security updates to address this ALPC vulnerability. Immediately download and install the latest cumulative security updates from the Microsoft Security Response Center (MSRC) for all affected Windows versions.

2

### Update affected systems

Ensure Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server (2012, 2016, 2019, 2022) are updated beyond vulnerable builds, specifically targeting versions later than 10.0.19045.7725 for Windows 10 22H2 and 10.0.20348.5622 for Server 2022.

3

### Restrict access

Because this vulnerability requires local access, enforce the principle of least privilege (PoLP). Audit and restrict interactive login permissions, ensuring only necessary personnel have local access to critical infrastructure and servers.

4

### Monitor for exploitation

Utilize Endpoint Detection and Response (EDR) tools to monitor for unusual process spawning from system services or unexpected memory corruption events. Look for low-privileged accounts suddenly executing commands with SYSTEM-level permissions.

## Detection Guidance

"Detection should focus on identifying anomalous behavior in the Windows ALPC subsystem. Monitor for unauthorized processes attempting to interact with system-level ALPC ports or unexpected crashes in the Local Security Authority Subsystem Service (LSASS). Security teams should also look for suspicious parent-child process relationships, such as a low-privileged user process spawning a shell with SYSTEM-level permissions, which is a common indicator of successful privilege escalation."

## References

[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880 Patch Vendor Advisory ](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-85880 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85880)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)