Microsoft Windows CVE-2026-85864

Requires authenticated local access (PR:L, AV:L): the attacker must already be able to execute code as a low-privileged local user on an affected Windows build. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors that reduce realistic risk: the flaw is not remotely exploitable (local vector only), it needs a pre-existing low-privilege foothold or valid local account, and only Windows builds below the fixed versions listed in EUVD (e.g. Windows 11 24H2 below 10.0.26100.9711, Windows Server 2022 below 10.0.20348.5761) are affected - patched systems are not exposed.

CVSS 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a local privilege-escalation flaw: the attacker must already have low-privileged authenticated local access (PR:L, AV:L), after which low-complexity exploitation (AC:L) yields full confidentiality, integrity, and availability impact - the classic profile of an escalation to SYSTEM. This is not a remotely reachable, wormable issue, so despite the HIGH base score its real-world urgency is moderated by the need for an existing foothold; it is primarily valuable as a post-exploitation / chaining primitive rather than an initial-access vector. No EPSS score, SSVC decision, KEV listing, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no confirmed active exploitation. Several signals conflict and should be verified with the vendor: the description attributes the flaw to 'Python' yet every affected product listed in EUVD is a Microsoft Windows edition and the reference/reporter are Microsoft MSRC, and the 'Information Disclosure' tag contradicts both the privilege-elevation description and the full C:H/I:H/A:H impact (which indicates elevation of privilege, not mere disclosure). Treat product attribution as unverified pending the MSRC advisory.

An attacker who already holds a low-privileged account or code-execution foothold on an affected, unpatched Windows system abuses the improper privilege management flaw to elevate to SYSTEM-level privileges without any user interaction. No public exploit has been identified at time of analysis, and because the attack vector is local (AV:L) it cannot be triggered remotely.