CVE-2026-85884: Windows Health and Optimized Experiences Service Elevation of Privilege Vulnerability
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.
Other sources
Windows Health and Optimized Experiences Service Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3231Patch KB5127646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26300.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9711Patch KB5127648
Event History
Frequently Asked Questions
Can this be exploited remotely or without an existing account?
No. The vulnerability is rated with local attack vector and low privileges required, and the description specifies that the attacker must be authorized.
Does exploitation require user interaction?
No. The CVSS vector indicates that no user interaction is required once an authorized local attacker is in a position to exploit the issue.
What is the likely impact after successful exploitation?
Successful exploitation can elevate local privileges and is rated as having high impact to confidentiality, integrity, and availability.