CVE-2026-85880

Imagine Windows has a “messaging system” it uses internally (ALPC). This flaw lets a person who already has a foothold on the machine (an authorized local attacker) take advantage of a bug to break out of normal permissions and run with much higher privileges. In practice, that can turn a limited compromise into near-complete control of the server or workstation.

This matters if you run or manage Windows 10 or Windows Server 2012/2012 R2/2016/2019/2022. Because CISA lists this issue as known to be exploited, you should assume it’s actively being used against real targets in the wild. It’s a local elevation-of-privilege problem, so it’s primarily a risk when an attacker can execute code on the machine (for example, via a compromise that gives them local access).

This is RED because CISA added CVE-2026-85880 to the KEV list, meaning it has been exploited in real-world attacks. Attackers can use it to go from limited local access to higher privileges, which is a common step before data theft or ransomware. You should remediate by the CISA due date: 2026-09-22.

1. Confirm exposure on each device:
   • For every Windows 10/Windows Server asset you own, identify the OS version/build.
   • Compare the installed build against the fixed versions below.
2. Apply the vendor fixes (target build/branch mapping):
   • Windows 10:
     • Fixed in 10.0.14393.9512
     • Fixed in 10.0.17763.9245
     • Fixed in 10.0.19044.7725
     • Fixed in 10.0.19045.7725
   • Windows Server:
     • 2012 fixed in 6.2.9200.26349
     • 2012 R2 fixed in 6.3.9600.23397
     • 2016 fixed in 10.0.14393.9512
     • 2019 fixed in 10.0.17763.9245
     • 2022 fixed in 10.0.20348.5622
3. Validate after patching:
   • Re-check the build number to ensure it matches or exceeds the fixed version for that OS.
   • Confirm Windows Update installed the relevant security update(s) without errors (and that the system is rebooted if required by your update process).
4. If patching is delayed or not possible:
   • Follow the mitigation instructions in Microsoft’s advisory for CVE-2026-85880 and the CISA KEV requirement for mitigations.
   • CISA guidance also indicates stakeholders should evaluate each asset’s internet exposure and follow CISA BOD 26-04 Prioritizing Security Updates Based on Risk; if mitigations aren’t available, discontinue use of the product as directed by the guidance.
5. What to monitor while you remediate:
   • Monitor for indicators of local compromise on endpoints/servers (unusual admin activity, suspicious local processes, and unexpected privilege changes), since this vulnerability’s impact depends on an attacker already being able to run code locally.
6. Timing:
   • CISA due date for KEV remediation: 2026-09-22.

Severity is rated as HIGH (CVSS 7.8). This is a Windows local elevation of privilege issue involving ALPC, with weakness classes including CWE-122 (heap-based buffer overflow) and CWE-908. The public exploitation status shows no public exploit code on record, but exploitation is confirmed via CISA KEV (added 2026-09-08) with a 2026-09-22 remediation due date. EPSS is reported as low (0.6%) and flat, but KEV listing takes precedence for urgency. Practically, the attacker must be able to run code locally (local/authorized attacker conditions) to trigger the memory corruption and elevate privileges. The main takeaway is that systems must be patched to the specific fixed build numbers published by Microsoft for each affected Windows version.