EUVD-2026-99487
GHSA-49r7-jm3v-9rw7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryInvoke targeted WMI operation
-
ExploitWin race to release invalid pointer
-
ExecutionExecute code as SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Pointer release safety
|
| Exploitation Conditions | Exploitation requires the attacker to already have local, authenticated access with at least low (standard-user) privileges on the affected Windows host - this is a local privilege-escalation flaw in the Windows Management Instrumentation service, not a remote one. The CVSS AC:H metric indicates a meaningful limiting factor: success depends on winning a high-complexity condition (consistent with a race/timing or specific state in the invalid-pointer release), so exploitation is not deterministic. No user interaction is required (UI:N), and no non-default configuration is called out in the description - WMI is present and enabled by default on all listed Windows client and server editions. The primary limiters are the need for prior local foothold plus the high attack complexity. |
| Impact | This is a genuine but moderate-priority local privilege escalation in Windows Management Instrumentation (WMI), driven by a release of an invalid pointer/reference (CWE-763). The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) tells a coherent story: the attacker must already have local, low-privileged access and must win a high-complexity condition (AC:H), consistent with a memory-corruption/race-type defect, but if successful achieves total compromise of confidentiality, integrity and availability on the host. Multiple exploitation signals point AWAY from urgency: CISA's SSVC decision framework rates Exploitation as 'none' and Automatable as 'no' (though Technical Impact is 'total'), there is no EPSS score provided, the CVE is not in CISA KEV, and no POC is referenced - exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (all low except technical impact), so this is a legitimate patch-management item rather than an emergency: a high-CVSS-but-low-real-risk profile for most environments, meaningful mainly where local code execution by low-privileged users is already possible. Note one metadata conflict to flag explicitly: the input Tags include 'Information Disclosure,' but the description describes privilege elevation, not information disclosure - verify with the vendor advisory. |
| Exploit ScenarioDerived | A low-privileged but authenticated local user (or malware already running in a standard user context) triggers the invalid-pointer-release flaw in WMI, likely by racing a specific WMI operation to win the high-complexity window. On success the attacker corrupts memory to execute code at SYSTEM, fully compromising the host. No public exploit code is identified at time of analysis, and the high attack complexity makes reliable exploitation non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in Windows Management Instrumentation (WMI) lets an attacker who already holds a low-privileged, authenticated foothold on a Windows host convert that access into elevated rights by triggering the release of an invalid pointer or reference inside the management service. The flaw is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local, requires standard-user privileges, needs no user interaction, and carries a high-complexity success condition, so exploitation is not deterministic and depends on winning a specific timing or state condition in the service. No public exploit code exists and there is no CISA KEV listing (SSVC exploitation: none), and Microsoft has released an update through its security update guide, making this a genuine but moderate-priority patching item rather than an urgent, actively exploited threat.
RemediationAI
Apply the vendor-supplied Windows cumulative update for CVE-2026-85362 as documented in the Microsoft Security Response Center update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85362); patch availability is reported as available from vendor, and the fixed builds correspond to the upper bounds of the affected ranges in the EUVD data, for example 10.0.17763.9376 for Windows Server 2019 and Windows 10 1809, 10.0.14393.9612 for Windows Server 2016 and Windows 10 1607, 10.0.20348.5761 for Windows Server 2022, 10.0.26100.33650 for Windows Server 2025, 6.2.9200.26434 for Windows Server 2012, and 6.3.9600.23470 for Windows Server 2012 R2. Because this is a local privilege-escalation issue that requires an existing standard-user foothold, the most effective compensating control where patching must be staged is to minimize the number of principals who can obtain interactive or secondary logon on affected hosts - restrict Remote Desktop, runas, and scheduled-task creation rights through Group Policy and remove unnecessary local administrator assignment, accepting that this narrows the attack surface only against new footholds and does nothing against an attacker who has already established one. Do not attempt to disable or stop the Winmgmt service or block WMI/DCOM traffic on hosts that depend on it: SCCM, monitoring agents, Exchange and SQL management tooling, and much of Windows management automation rely on WMI, and disabling it will break those stacks while often failing to remove the vulnerable provider code path. If a hard constraint prevents patching, combine strict least-privilege enforcement for local logon with enhanced detection for anomalous WMI activity and unexpected process creation from high-integrity WMI host processes, and prioritize patching on multi-user systems such as Remote Desktop Session Hosts and servers where non-administrative accounts are common. Note that the high attack complexity means exploitation attempts may be unreliable and noisy rather than silent, so integrity monitoring on the WMI service host remains worthwhile even after patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WMI is the Windows implementation of the WBEM/CIM management stack, hosted by the Winmgmt service and reachable through DCOM and WinRM/WS-Man, with numerous inbox providers that broker management data between user processes and kernel or privileged components. Because that service and many of its providers execute in a high-integrity context, memory-safety defects inside WMI are a classic local privilege-escalation vector. CVE-2026-85362 is classified as CWE-763 (Release of Invalid Pointer or Reference), meaning the root cause is a memory-management error in which code frees a pointer that is stale, already released, or otherwise not a valid allocation - a class that typically manifests as a double-free or use-after-free, corrupting the heap and potentially allowing the attacker to redirect control flow within the affected process. The CVSS vector's AC:H metric indicates the attacker does not control the outcome deterministically and must satisfy a hard precondition (consistent with a race or a narrowly ordered state transition in the pointer-release path), while S:U confirms the compromise is contained to the security authority of the vulnerable WMI component rather than crossing a scope boundary. WMI is installed and running by default on every Windows client and server edition listed as affected, so no non-default configuration is required on the target; the only prerequisites are a prior authenticated local foothold and the ability to arrange the vulnerable state. The SSVC assessment rates technical impact as total once the primitive succeeds.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only EoP requiring an existing low-privileged account (AV:L, PR:L); CWE-763 invalid-pointer release implies a race/timing window (AC:H); success yields SYSTEM-level total impact (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A privilege-escalation vulnerability in Windows Management Instrumentation (WMI), a management service present on virtually every Windows server and workstation we operate, would let an attacker who already holds a standard user account on a machine raise their rights to administrative level. Because a foothold on the host is a precondition and successful exploitation depends on a difficult-to-win timing condition, this is a scheduled remediation obligation rather than an emergency, but the near-universal Windows footprint means the affected population is effectively our entire endpoint and server estate. Leadership should care because unpatched local escalation paths are consistently used in the post-compromise phase of ransomware and insider scenarios to move from a single user account to full control of a host.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB