Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-85880: Windows 10 and Server 2012 Privilege Escalation via RPC

CVE-2026-85880 · published 1 month ago · actively exploited

Summary

Certain versions of Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012 contain a flaw in the Advanced Local Procedure Call component that could let a local attacker gain higher system rights. This could let malicious software run with full administrative control. Install the latest security updates from Microsoft as soon as possible to close the gap.

What to do

Update microsoft windows 10 version 1607 to version 10.0.14393.9512 or later.
Update microsoft windows 10 version 1809 to version 10.0.17763.9245 or later.
Update microsoft windows 10 version 21h2 to version 10.0.19044.7725 or later.
Update microsoft windows 10 version 22h2 to version 10.0.19045.7725 or later.
Update microsoft windows server 2012 to version 6.2.9200.26349 or later.
Update microsoft windows server 2012 (server core installation) to version 6.2.9200.26349 or later.
Update microsoft windows server 2016 to version 10.0.14393.9512 or later.
Update microsoft windows server 2016 (server core installation) to version 10.0.14393.9512 or later.
Update microsoft windows server 2019 to version 10.0.17763.9245 or later.
Update microsoft windows server 2019 (server core installation) to version 10.0.17763.9245 or later.
Update microsoft windows server 2022 to version 10.0.20348.5622 or later.
Update microsoft windows_10_1607 to version 10.0.14393.9512 or later.
Update microsoft windows_10_1809 to version 10.0.17763.9245 or later.
Update microsoft windows_10_21h2 to version 10.0.19044.7725 or later.
Update microsoft windows_10_22h2 to version 10.0.19045.7725 or later.
Update microsoft windows_server_2016 to version 10.0.14393.9512 or later.
Update microsoft windows_server_2019 to version 10.0.17763.9245 or later.
Update microsoft windows_server_2022 to version 10.0.20348.5622 or later.

Affected software

Vendor	Product	Affected versions
microsoft	windows 10 version 1607	< 10.0.14393.9512
microsoft	windows 10 version 1809	< 10.0.17763.9245
microsoft	windows 10 version 21h2	< 10.0.19044.7725
microsoft	windows 10 version 22h2	< 10.0.19045.7725
microsoft	windows server 2012	< 6.2.9200.26349
microsoft	windows server 2012 (server core installation)	< 6.2.9200.26349
microsoft	windows server 2012 r2	< 6.3.9600.23397 < 6.3.9600.23398
microsoft	windows server 2012 r2 (server core installation)	< 6.3.9600.23397 < 6.3.9600.23398
microsoft	windows server 2016	< 10.0.14393.9512
microsoft	windows server 2016 (server core installation)	< 10.0.14393.9512
microsoft	windows server 2019	< 10.0.17763.9245
microsoft	windows server 2019 (server core installation)	< 10.0.17763.9245
microsoft	windows server 2022	< 10.0.20348.5622
microsoft	windows	All versions
microsoft	windows_10_1607	< 10.0.14393.9512 `cpe:2.3:o:microsoft:windows_10_1607:::::::x64:*`
microsoft	windows_10_1809	< 10.0.17763.9245 `cpe:2.3:o:microsoft:windows_10_1809:::::::x64:*`
microsoft	windows_10_21h2	< 10.0.19044.7725 `cpe:2.3:o:microsoft:windows_10_21h2:::::::arm64:*`
microsoft	windows_10_22h2	< 10.0.19045.7725 `cpe:2.3:o:microsoft:windows_10_22h2:::::::arm64:*`
microsoft	windows_server_2012	r2 `cpe:2.3:o:microsoft:windows_server_2012:-:::::::*`
microsoft	windows_server_2016	< 10.0.14393.9512 `cpe:2.3:o:microsoft:windows_server_2016::::::::`
microsoft	windows_server_2019	< 10.0.17763.9245 `cpe:2.3:o:microsoft:windows_server_2019::::::::`
microsoft	windows_server_2022	< 10.0.20348.5622 `cpe:2.3:o:microsoft:windows_server_2022::::::::`

Original advisory text

Microsoft Windows Heap-Based Buffer Overflow Vulnerability

Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880 vendor-advisory patch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-... US Government Resource

Fix within

Internet-facing 3 days

and check for signs of compromise

Internal 14 days

Known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.8 High

Exploitation

Known exploited

Listed in the CISA KEV catalogue - exploitation confirmed in the wild.

<1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

CWE-908Use of Uninitialized Resource

Timeline

Published8 Sep 2026

Updated4 Nov 2026

First seen8 Sep 2026

Sources

CVE-2026-85880 · NVD

CVE-2026-85880 · MITRE

CVE-2026-85880 · CISA KEV

Track software like this

Free during beta