CVE-2026-85880: Microsoft Windows Privilege Escalation Vulnerability
- Severity
- HIGH
- Affected component
- windows (other)
- Patched version
- Not yet available
A high-severity vulnerability in Microsoft Windows Advanced Local Procedure Call allows an attacker to elevate privileges locally. This threat is confirmed and has been exploited in the wild.
What happened
The vulnerability, tracked as CVE-2026-85880, is a heap-based buffer overflow in Microsoft Windows Advanced Local Procedure Call. An attacker can exploit this flaw to elevate privileges on a local system. The vulnerability was first flagged and confirmed on September 8, 2026. It is critical for system administrators and users to take immediate action to mitigate this threat.
Although the exact version range of affected Windows systems has not been authoritatively published, all users of Microsoft Windows are advised to monitor for patches and apply them as soon as they become available. The vulnerability has been actively exploited, making it imperative to address this issue promptly.
What to do about it
- Monitor official Microsoft security advisories and Windows Update for patches related to CVE-2026-85880.
- Apply any available patches immediately upon release to mitigate the risk of exploitation.
- Review system logs for any signs of unusual activity that may indicate a compromise.
- Consider implementing additional security measures such as application whitelisting and least privilege principles to reduce the attack surface.
- No official fix has been published yet for the affected Windows versions. Continue to monitor the sources below for updates.
How 0Day would have caught this
windows is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
The exact version range of affected Windows systems has not been published. However, all users of Microsoft Windows should assume potential risk and take preventive measures.
What should I do right now?
Monitor for patches and apply them as soon as they are available. Review system logs for unusual activity and consider implementing additional security measures.
Has this been exploited in the wild?
Yes, this vulnerability has been confirmed to be exploited in the wild.
Sources
- NCSC-2026-0353 [1.00] [M/H] Kwetsbaarheden verholpen in Microsoft Windows
- NCSC-2026-0355 [1.00] [M/H] Kwetsbaarheden verholpen in Fortinet Forti-producten
- [GHSA-7rhf-42qf-vrvc] gix-sec safe.directory protections absent for elevated administrators
- [GHSA-p293-qw3h-jr36] Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
- [GHSA-rrxg-g2pf-6hh4] ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
- [GHSA-8cp2-47hg-mfgh] Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability
- [GHSA-2j8r-3c22-8565] Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability
- [GHSA-527h-q9f6-p7qx] Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability