CVE-2026-85880

Imagine Windows has a “messaging system” it uses internally (ALPC). This flaw lets a person who already has a foothold on the machine (an authorized local attacker) take advantage of a bug to break out of normal permissions and run with much higher privileges. In practice, that can turn a limited compromise into near-complete control of the server or workstation.

This matters if you run or manage Windows 10 or Windows Server 2012/2012 R2/2016/2019/2022. Because CISA lists this issue as known to be exploited, you should assume it’s actively being used against real targets in the wild. It’s a local elevation-of-privilege problem, so it’s primarily a risk when an attacker can execute code on the machine (for example, via a compromise that gives them local access).

This is RED because CISA added CVE-2026-85880 to the KEV list, meaning it has been exploited in real-world attacks. Attackers can use it to go from limited local access to higher privileges, which is a common step before data theft or ransomware. You should remediate by the CISA due date: 2026-09-22.