BlackTreeCVE Intelligence
← Back to the CVE catalogue
Full vulnerability report · 2026
CVE-2026-85880High confidence

Microsoft Windows Heap-Based Buffer Overflow Vulnerability

Microsoft · Windows

7.8HighCVSS 3.1
Recommended action
Patch now

CISA confirms exploitation in the wild and lists 2026-09-22 as the remediation due date.

Patch available
Optional official sources

National CERT insights
?CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

Select the national-authority views to include. The exact source language is shown on each matched advisory. Your choice is remembered on this device and encoded in the shareable URL.

Official European source

ENISA European Vulnerability Database

Official EUVD identifiers, advisory evidence and known-exploited context. Missing fields are not treated as evidence of low risk.

1 current
ENISA EUVD identifier

EUVD-2026-73365

CISA KEV mirrored by ENISA

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

EUVD state
Present in the current official mapping
Known exploitation
Recorded by ENISA since 8 Sept 2026. Evidence sources: cisa_kev.
ENISA score
7.8 · CVSS 3.1
Advisory evidence
1 linked advisory record
Explicit mitigation evidence

Only statements that explicitly mention a fix, patch, update, workaround or mitigation are shown here.

  • csaf_ncscnl · NCSC-2026-0353Kwetsbaarheden verholpen in Microsoft Windows
Recommended actionPatch now

CISA confirms exploitation in the wild and lists 2026-09-22 as the remediation due date.

Patch available
01

What, why and how

Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.

What

Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.

Why

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

How

An attacker operating through local access may attempt exploitation with low privileges. If successful, the issue may gain additional privileges.

What

Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.

Why

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

How

An attacker operating through local access may attempt exploitation with low privileges. If successful, the issue may gain additional privileges.

02

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation
?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.
Confirmed in the wild

CISA added this CVE to its Known Exploited Vulnerabilities catalogue on 2026-09-08.

Public PoC / exploit material
?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.
None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path
local access → Heap-based Buffer Overflow → gain additional privileges
Attack surface
Local
Privileges required
Low: a basic authenticated account is required
User interaction
None
Attack complexity
Low: no specialised conditions are recorded
Security boundary
Unchanged: impact remains within the vulnerable component's security authority
Weakness
?CWE means Common Weakness Enumeration: a standard category for the underlying weakness.
CWE-122 ↗

CWE-122: Heap-based Buffer Overflow. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

CVSS vector
?CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.

AVLocalAttack vector: The attacker needs local access to the vulnerable system.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRLowPrivileges required: The attacker needs basic user-level privileges.UINoneUser interaction: No action by another user is required.SUnchangedScope: The security impact remains within the vulnerable component's authority.CHighConfidentiality impact: A successful attack can cause a major loss.IHighIntegrity impact: A successful attack can cause a major loss.AHighAvailability impact: A successful attack can cause a major loss.
Post-exploitation / living off the land
The issue can support a local privilege or sandbox boundary transition; normal system utilities may then be available in the gained context.
Privilege escalationCWE-122CISA KEV
A

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

ENISA EUVD · EUVD-2026-73365Known-exploited evidence recorded

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Official EUVD record ↗
BSI · German · WID-SEC-2026-3243Microsoft Windows: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in verschiedenen Versionen von Microsoft Windows Server, Microsoft Windows 10 und Microsoft Windows 11 ausnutzen, um seine Privilegien zu erhöhen, um einen Denial of Service herbeizuführen, um Informationen offenzulegen und um beliebigen Code auszuführen.

Official advisory ↗
Canadian Centre for Cyber Security · English · AV26-896Microsoft security advisory – September 2026 monthly rollup (AV26-896) – Update 1

As of September 8, 2026, Microsoft is affected by vulnerabilities in the following products: Microsoft has indicated that CVE-2026-81963 and CVE-2026-85880 have been exploited.

Official advisory ↗
INCIBE-CERT · Spanish · boletin-de-seguridad-de-microsoft-septiembre-de-2026Boletín de seguridad de Microsoft: septiembre de 2026

rvices for NFS ONCRPC XDR Driver CVE-2026-78509: vulnerabilidad de Ejecución Remota de Código en Microsoft Office Outlook CVE-2026-78510: vulnerabilidad de Ejecución Remota de Código en Microsoft Word CVE-2026-80098: vulnerabilidad de Elevación de Privilegios en Copilot Studio CVE-2026-81376: vulnerabilidad de Omisión de Característica de Seguridad en Visual Studio Code CVE-2026-81963: vulnerabilidad de Elevación de Privilegios en Windows Update Stack (Está siendo explotada) CVE-2026-83711: vulnerabilidad de Elevación de Privilegios en Microsoft Azure Active Directory B2C CVE-2026-83941: vulnerabilidad de Elevación de Privilegios en Entra ID CVE-2026-85880: vulnerabilidad de Elevación de Privilegios en Windows Advanced Local Procedure Call (ALPC) (Está siendo explotada) Los códigos CVE asignados a las vulnerabilidades no críticas reportadas pueden consultarse en las referencias. CVE Identificador CVE Severidad Explotación Fabricante CVE-2026-62916 Crítica No Microsoft CVE-2026-65669 Crítica No Microsoft CVE-2026-66302 Crítica No Microsoft CVE-2026-68839 Crítica No Microsoft CVE-2026-69276 Crítica No Microsoft CVE-2026-69356 Crítica No Microsoft CVE-2026-69380 Crítica No Microsoft CVE-2026-69408 Crítica No Microsoft CVE-2026-69431 Crítica No Microsoft CVE-2026-69463 Crítica No Microsoft CVE-202

Official advisory ↗
CERT-FR · French · CERTFR-2026-AVI-1147Multiples vulnérabilités dans Microsoft Windows

embre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-83991 du 08 septembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-83992 du 08 septembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-83996 du 08 septembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-83998 du 08 septembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-83999 du 08 septembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-84001 du 08 septembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-85360 du 08 septembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-85877 du 08 septembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-85880 du 08 septembre 2026 Une gestion de version détaillée se trouve à la fin de ce document. Risques Atteinte à l'intégrité des données Atteinte à la confidentialité des données Contournement de la politique de sécurité Déni de service à distance Exécution de code arbitraire à distance Élévation de privilèges Systèmes affectés Remote Desktop client pour Windows Desktop versions antérieures à 1.2.7279.0 Windows 10 Version 1607 pour systèmes 32 bits versions antérieures à 10.0.14393.9504 Windows 10 Version 1607 pour systèmes 32 bits versions antérieures à 10.0.14393.9512 Windows 10 Version 1607 pour systèmes x64 versions antérieures à 10.0.14393.9

Official advisory ↗
NBSZ-NKI · Hungarian · cve-2026-85880CVE-2026-85880

A halom túlcsordulás egy típusú puffer túlcsordulás, ahol a felülírható puffer a memória dinamikusan részében van kiosztva, ami általában azt jelenti, hogy a puffert egy olyan függvénnyel osztották ki, mint pl. a malloc(). A termék inicializálatlan erőforrást használ vagy ér el, ami kiszámíthatatlan működést eredményezhet. Ennek következménye lehet összeomlás, érvénytelen memóriaművelet vagy egyéb, az érintett erőforrás típusától és felhasználási módjától függő rendellenes működés.

Official advisory ↗
CSIRT Italia · Italian · aggiornamenti-mensili-microsoft-24Aggiornamenti Mensili Microsoft

taglio le vulnerabilità sfruttate attivamente, riguardano: Windows Update Stack: identificata tramite la CVE-2026-81963, di tipo “Elevation of Privilege” e con score CVSS v3.1 pari a 7.8. Tale vulnerabilità interessa lo stack di gestione degli aggiornamenti del sistema operativo ed è dovuta ad una non corretta risoluzione dei collegamenti prima dell'accesso ai file (meccanismo denominato "link following"). Nel dettaglio, un attaccante locale autenticato potrebbe sfruttare questa incongruenza per manipolare i percorsi del file system ed elevare i propri privilegi fino al livello SYSTEM sul sistema target. Windows ALPC: identificata tramite la CVE-2026-85880, di tipo “Elevation of Privilege” e con score CVSS v3.1 pari a 7.8. Tale vulnerabilità interessa il meccanismo di comunicazione interprocesso Advanced Local Procedure Call ed è causata da una non corretta gestione della memoria allocata (heap-based buffer overflow) durante la gestione dei messaggi o delle strutture dati. Nel dettaglio, un attaccante locale autenticato potrebbe sfruttare tale condizione per alterare il flusso di esecuzione del software ed elevare i propri privilegi fino al livello SYSTEM sul sistema target. Inoltre, si evidenziano due ulteriori vulnerabilità di tipo RCE che, pur non risultando al momento sfruttate, presentano

Official advisory ↗
KISA KrCERT/CC · Korean · KNVD-6946MS 9월 보안 위협에 따른 정기 보안 업데이트 권고

Service | CVE-2026-83999 | Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability | | Microsoft Graphics Component | CVE-2026-84000 | Microsoft 그래픽 구성 요소 원격 코드 실행 취약성 | | Windows Key Distribution Center | CVE-2026-84001 | Windows 키 배포 센터 서비스 거부 취약성 | | Microsoft Authentication Library (MSAL) for Node.js | CVE-2026-84003 | Microsoft 인증 라이브러리 (MSAL) Node.js용 스푸핑 취약성 | | Windows Kernel | CVE-2026-85360 | Windows 커널 권한 상승 취약성 | | Microsoft Office Excel | CVE-2026-85875 | Microsoft Office Excel 정보 유출 취약성 | | Windows Print Spooler Components | CVE-2026-85877 | Windows 인쇄 스풀러 원격 코드 실행 취약성 | | Windows ALPC | CVE-2026-85880 | Windows ALPC(고급 로컬 프로시저 호출) 권한 상승 취약성 | | Microsoft Edge (Chromium-based) | CVE-2026-84323 | Chromium: CVE-2026-84323 FileSystem에서 권한 부여 누락 | | Microsoft Edge (Chromium-based) | CVE-2026-84324 | Chromium: CVE-2026-84324 프록시에서의 사용 후 해제 | | Microsoft Edge (Chromium-based) | CVE-2026-84325 | Chromium: CVE-2026-84325 Improper input validation in DataTransfer | | Microsoft Edge (Chromium-based) | CVE-2026-84326 | Chromium: CVE-2026-84326 V8에서 초기화되지 않은 리소스 | | Microsoft Edge (Chromium-based) | CVE-2026-84327 | Chromium: CVE-2026-84327 자동 완성에서의 잘못된 권한 부여 | | Microsoft Edge (Chromium-based) | CVE-2026-84328 | Chromium: CVE-2026-84328 FileSystem의 권

Official advisory ↗
KISA KrCERT/CC · Korean · KNVD-6945美 CISA 발표 주요 Exploit 정보공유(Update. 2026-09-08)

Microsoft Windows Heap-Based Buffer Overflow Vulnerability

Official advisory ↗
NCSC-NL · Dutch · NCSC-2026-0353Kwetsbaarheden verholpen in Microsoft Windows

Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade, zoals genoemd in onderstaande tabel. Microsoft heeft voor Windows 666 kwetsbaarheden verholpen. De 32 ernstigste kwetsbaarheden bevinden zich in meerdere Windows componenten en hebben een CVSS score van 9.0 en hoger toegewezen gekregen. Kwaadwillenden met toegang tot deze componenten kunnen zonder voorafgaande authenticatie mogelijk code uitvoeren of zich toegang verschaffen tot het kwetsbare systeem. Deze kwetsbaarheden zijn in onderstaande tabel weergegeven. De overige 634 kwetsbaarheden variëren in ernst van middelmatig tot hoog en kritiek. Raapleeg het MSRC-portaal voor aanvullende informatie. ==**UPDATE**== De kwetsbaarheid met kenmerk CVE-2026-81963 heeft een CVSS-score van 7,8. Het betreft een privilege-escalatiekwetsbaarheid in de Windows Update Stack. Een geauthenticeerde kwaadwillende kan deze kwetsbaarheid lokaal misbruiken om zijn rechten te verhogen en SYSTEM-rechten te verkrijgen. Microsoft meldt dat de kwetsbaarheid actief wordt misbruikt. Er zijn geen details bekend over de wijze waarop de kwetsbaarheid bij aanvallen wordt misbruikt. De kwetsbaarheid met kenmerk CVE-2026-85880 heeft een CVSS-score van 7,8. Het betreft een privilege-escalatiekwetsbaarheid in Windows Advanced Local Procedure Call (ALPC). Een geauthenticeerde kwaadwillende kan deze kwetsbaarheid lokaal misbruiken om zijn rechten te verhogen en SYSTEM-rechten te verkrijgen. Microsoft meldt dat de kwetsbaarheid actief wordt misbruikt. Er zijn geen details bekend over de wijze waarop de kwetsbaarheid bij aanvallen wordt misbruikt. ==**EINDE UPDATE**== ``` |----------------|------|---------------------------|-------------------------------------| | CVE-ID | CVSS | Component | Impact | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-73025 | 9,80 | iSCSI | Omzeilen van beveiligingsmaatregel | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69276 | 9,80 | UxTheme Library | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-70296 | 9,80 | Imaging | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69730 | 9,80 | DNS | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| |CVE-2026-69824 | 9,80 | XPS | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| |CVE-2026-69590 | 9,80 | RRAS | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69463 | 9,80 | NTFS | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69669 | 9,80 | NTFS | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69845 | 9,80 | DHCP Server | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-72979 | 9,80 | DHCP Server | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69595 | 9,80 | NFS ONCRPC | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-78445 | 9,80 | NFS ONCRPC | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69829 | 9,80 | SHELL | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-72983 | 9,80 | ICS | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69579 | 9,80 | Message Queuing | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69496 | 9,80 | Compressed Folder | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69774 | 9,00 | Hyper-V | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69910 | 9,80 | Hyper-V | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-72982 | 9,80 | Netlogon | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69769 | 9,80 | HTTP Print Provider | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69431 | 9,80 | Telnet Client | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69639 | 9,80 | Libarchive | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69819 | 9,80 | RPC Runtime | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69493 | 9,80 | Event Logging Service | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69434 | 9,80 | URL Moniker | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69715 | 9,80 | Direct Show | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-73009 | 9,80 | SSTP | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-68839 | 9,80 | USB Mass Storage Class | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-68839 | 9,80 | Remote Desktop Services | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69525 | 9,80 | USB Mass Storage Class | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-73010 | 9,80 | Failover Cluster | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-69768 | 9,80 | RNDIS | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| | CVE-2026-77493 | 9,80 | Office Outlook | Uitvoeren van willekeurige code | |----------------|------|---------------------------|-------------------------------------| ```

Official advisory ↗
03

Patch and workaround

Operational remediation based on structured source evidence.

Status
?Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.
Patch available
Affected
Fixed
An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
Action
Review the linked authoritative reference and apply the recorded fixed release appropriate to the affected product branch.
Workaround
No verified workaround is recorded. Limit untrusted access and use least privilege until authoritative guidance is available.
04

Evidence and provenance

Published 8 Sept 2026 · Last source change 11 Sept 2026, 22:12 UTC · CWE-122 · Heap-based Buffer Overflow

CVE recordCVE.org · 5.2
CVSS sourceCNA
EPSS source
?The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.
FIRST · tracked since 2026-09-09
European sourceENISA EUVD · EUVD-2026-73365
Product sourceCNA
Remediation sourceCVE/CNA references
CWE sourceOther authority
NVD statusNVD enriched

Core structured fields are present and their contributing authorities are shown above.

Material change intelligence

What changed after publication

View recent updates ↗
  1. Affected versionsThe structured affected or fixed version information changed.
    Before
    10.0.14393.0 < 10.0.14393.9512; 10.0.17763.0 < 10.0.17763.9245; 10.0.19044.0 < 10.0.19044.7725; 10.0.19045.0 < 10.0.19045.7725; 6.2.9200.0 < 6.2.9200.26349; 6.3.9600.0 < 6.3.9600.23397 · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
    After
    Windows 10 Version 1607: 10.0.14393.0 < 10.0.14393.9512; Windows 10 Version 1809: 10.0.17763.0 < 10.0.17763.9245; Windows 10 Version 21H2: 10.0.19044.0 < 10.0.19044.7725; Windows 10 Version 22H2: 10.0.19045.0 < 10.0.19045.7725; Windows Server 2012: 6.2.9200.0 < 6.2.9200.26349; Windows Server 2012 (Server Core installation): 6.2.9200.0 < 6.2.9200.26349; Windows Server 2012 R2: 6.3.9600.0 < 6.3.9600.23397; Windows Server 2012 R2 (Server Core installation): 6.3.9600.0 < 6.3.9600.23397; Windows Server 2016: 10.0.14393.0 < 10.0.14393.9512; Windows Server 2016 (Server Core installation): 10.0.14393.0 < 10.0.14393.9512; Windows Server 2019: 10.0.17763.0 < 10.0.17763.9245; Windows Server 2019 (Server Core installation): 10.0.17763.0 < 10.0.17763.9245; Windows Server 2022: 10.0.20348.0 < 10.0.20348.5622 · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
    CNA ↗
  2. BlackTree coverageBlackTree article coverage changed from 2 BlackTree articles to 3 BlackTree articles.
    Before
    2 BlackTree articles
    After
    3 BlackTree articles
    BlackTree editorial ↗
  3. ENISA known-exploited stateENISA EUVD now records this CVE in its known-exploited dataset.
    Before
    not recorded
    After
    {"euvdId":"EUVD-2026-73365","listed":true,"sources":["cisa_kev"]}
    ENISA EUVD ↗
  4. ENISA EUVD mappingEUVD-2026-73365 was added to the official ENISA EUVD mapping for this CVE.
    Before
    not recorded
    After
    {"euvdId":"EUVD-2026-73365"}
    ENISA EUVD ↗
  5. BlackTree coverageBlackTree article coverage changed from no BlackTree article to 2 BlackTree articles.
    Before
    no BlackTree article
    After
    2 BlackTree articles
    BlackTree editorial ↗
  6. Vendor guidanceAuthoritative vendor guidance changed from no authoritative guidance recorded to authoritative remediation link · patch.
    Before
    no authoritative guidance recorded
    After
    authoritative remediation link · patch
    secure@microsoft.com ↗
  7. Affected versionsThe structured affected or fixed version information changed.
    Before
    10.0.14393.0 < 10.0.14393.9512; 10.0.17763.0 < 10.0.17763.9245; 10.0.19044.0 < 10.0.19044.7725; 10.0.19045.0 < 10.0.19045.7725; 6.2.9200.0 < 6.2.9200.26349; 6.3.9600.0 < 6.3.9600.23397 · Fixed: No fixed version is explicitly recorded in the structured CVE data.
    After
    10.0.14393.0 < 10.0.14393.9512; 10.0.17763.0 < 10.0.17763.9245; 10.0.19044.0 < 10.0.19044.7725; 10.0.19045.0 < 10.0.19045.7725; 6.2.9200.0 < 6.2.9200.26349; 6.3.9600.0 < 6.3.9600.23397 · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
    CNA ↗
  8. Remediation statusRemediation status changed from Awaiting fix to Patch available.
    Before
    Awaiting fix
    After
    Patch available
    secure@microsoft.com ↗
  9. Catalogue recordCVE added to the BlackTree catalogue.
    CNA ↗
Material fields only · duplicate refreshes suppressed · history retained for the configured operational retention period
CVE published
Added to CISA KEV
Fixed release or patch reference recorded
ENISA EUVD · EUVD-2026-73365↗CISA KEV record↗CVE authority or vendor reference↗Official CVE record (CNA and ADP data)↗NVD record↗
Technical terms and abbreviations used in this report
CVE
Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS
Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS
Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE
Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA
CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP
Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD
National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT
A computer security incident response team that publishes warnings or coordinates incident response.
PoC
Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF
Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL
Living off the land: abuse of legitimate tools or system functions during an attack.
Free version - for non-commercial use only.CVE-2026-85880 · cve.blacktree.nl