Microsoft Patches Windows SmartScreen Privilege Escalation Flaw CVE-2026-85851

Microsoft released security updates on October 13, 2026, to address a privilege escalation vulnerability in Windows SmartScreen. The flaw, tracked as CVE-2026-85851, allows an attacker with local access to gain higher privileges on affected devices.

The vulnerability carries a CVSS base score of 7.8, which Microsoft rates as Important. It involves a use-after-free memory error that enables an attacker to move from a low integrity level to a medium integrity level. This specific increase in access does not provide a confirmed path to administrator or SYSTEM privileges.

Technical Details and Context

The issue falls under CWE-416, a use-after-free error where software accesses memory after it has been released. This can lead to memory corruption or other security problems. Microsoft’s CVSS vector indicates low attack complexity and no user interaction is required.

According to Cyber Security News, the advisory marks the flaw as neither publicly disclosed nor exploited. Microsoft assessed exploitation as “Exploitation Less Likely.” This assessment distinguishes the issue from actively exploited zero-days, though patching remains necessary.

Affected Systems and Related Issues

The vulnerability affects several Windows 11 releases and Windows Server 2025. An attacker must already have low privileges on the device to exploit this flaw. It does not allow remote exploitation over the internet.

Microsoft also disclosed CVE-2026-83504, a separate Windows SmartScreen information disclosure flaw rated CVSS 4.7. This second issue is a time-of-check-to-time-of-use race condition that could allow viewing heap memory from a privileged process.

What should you do?

Organizations should verify that all Windows 11 and Windows Server 2025 devices have received the October 2026 security updates. Administrators should monitor for any signs of local privilege escalation attempts on systems that have not yet been patched.

What to do and how to stay safe: Microsoft

• Apply the October 2026 security updates to all affected Windows 11 and Windows Server 2025 systems immediately.
• Verify that local accounts with low privileges are monitored for unusual privilege escalation attempts.
• Review system logs for signs of memory corruption or unexpected process behavior that may indicate exploitation.
• Ensure that security tools are configured to detect local privilege escalation activities on endpoints.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-85851?

It is a use-after-free vulnerability in Windows SmartScreen that allows local attackers to elevate privileges from low to medium integrity levels.

Which systems are affected by this vulnerability?

Several Windows 11 releases and Windows Server 2025 are affected by this privilege escalation flaw.

Is this vulnerability being actively exploited?

No, Microsoft assessed exploitation as “Exploitation Less Likely” and marked it as not publicly exploited at publication.