Microsoft Windows CVE-2026-85329

Exploitation requires the attacker to already have local, authenticated access to the Windows host with at least low-level privileges (PR:L) - this is not remotely reachable (AV:L). The core prerequisite is winning a race condition in the Microsoft Account component's unsynchronized access to a shared resource, which demands precise timing and typically many repeated attempts; this timing dependency (AC:H) is the primary limiting factor and makes reliable, automatable exploitation impractical (SSVC Automatable: no). No user interaction is required (UI:N). The flaw affects default Windows installations across the enumerated client and server builds, so no special non-default configuration is needed beyond standard local access.

This is a genuine but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) describes a local attacker who already holds low-level privileges and must win a timing-sensitive race condition - the AC:H and AV:L metrics substantially constrain real-world exploitability, which is why the base score lands at 7.0 (High) rather than Critical despite full C:H/I:H/A:H impact. The SSVC decision framework reinforces a lower-urgency posture: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (consistent with AC:H - a race cannot be reliably sprayed at scale), while Technical Impact is 'total' (consistent with the H/H/H impact set). There is no CISA KEV listing and no EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. All signals are mutually consistent and point the same direction: high technical impact if exploited, but meaningful difficulty (local access + privileges + timing) and no evidence of exploitation. Treat as a standard-cadence patch priority for the next Windows maintenance window rather than an emergency, with the caveat that the affected component (Microsoft Account) is present across the entire Windows fleet, so patch coverage must be broad.

A local attacker who already has an unprivileged or standard authenticated session on a Windows host repeatedly triggers the vulnerable Microsoft Account operation to hit a narrow timing window in which a shared resource is accessed without proper synchronization. By winning that race, the attacker corrupts privileged state and elevates to SYSTEM-level control of the machine. No public exploit identified at time of analysis, and the high attack complexity (race condition) means exploitation typically requires many attempts rather than a single deterministic action.