Windows Health Service CVE-2026-85884

Requires the attacker to already have local, authenticated access with at least low privileges on the target (PR:L, AV:L) - e.g. an interactive standard-user session or an existing low-privilege code-execution foothold; it is NOT remotely exploitable. The vulnerable component is the Windows Health and Optimized Experiences Service, which runs by default on affected Windows 11 builds (24H2, 25H2, 26H1, 26H2), so no special non-default configuration is needed. No user interaction is required (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the local-access prerequisite: this is an escalation primitive to be chained after initial access, not an initial entry vector.

This is a credible, actionable local privilege escalation (CWE-306, missing authentication for a critical function) in the Windows Health and Optimized Experiences Service. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: a local attacker who already holds low privileges (PR:L, an 'authorized attacker') can elevate to high confidentiality/integrity/availability impact with low attack complexity and no user interaction. Signals partially conflict on urgency: severity is HIGH and the product footprint is ubiquitous, but there is no CISA KEV listing, no public POC, and no EPSS score supplied - so despite the broad attack surface this currently reads as a patch-on-cycle item rather than an emergency. EPSS is absent (not low), so exploitation probability cannot be quantified from this input; the KEV absence means no confirmed active exploitation. The 'Authentication Bypass' tag slightly overstates the mechanism - this is missing authentication on a critical function usable for local EoP, not a remote auth bypass - verify scope with the MSRC advisory. Net: real priority for Windows 11 fleets because of ubiquity and the local-to-SYSTEM elevation pattern typical of these service flaws, but no evidence of in-the-wild use yet.

A standard (non-admin) user, or malware running in a low-privilege context after initial access, invokes the unprotected critical function exposed by the Windows Health and Optimized Experiences Service to gain SYSTEM-level privileges on the local machine. Because the CVSS vector is local with low attack complexity and no user interaction (AV:L/AC:L/UI:N), exploitation is reliable once code runs on the host, though the attacker must already be authenticated locally (PR:L). No public exploit code has been identified at time of analysis.