CVE-2026-85360

CVE-2026-85360 is a use-after-free (CWE-416) memory-safety flaw in the Windows kernel. An attacker with valid low-privileged local access must execute code that triggers the flawed kernel memory handling (rated high attack complexity, suggesting a timing- or race-sensitive trigger), causing the kernel to reference freed memory. Successful exploitation elevates the attacker's privileges locally, typically to SYSTEM, giving full control of the affected machine. It affects a broad range of supported Windows 10 and Windows 11 client builds as well as Windows Server 2012 through 2022, so nearly any Windows endpoint or server in an organization's fleet may be in scope. No public proof-of-concept, no CISA KEV listing, and a low EPSS (0.2%, 14th percentile) indicate exploitation is not known at publication, though the flaw was disclosed amid Microsoft's September 2026 Patch Tuesday, which fixed 973 vulnerabilities including two exploited zero-days.

What to do: Apply Microsoft's September 2026 cumulative security updates for each affected Windows 10, Windows 11, and Windows Server build via Windows Update, WSUS, or your patch-management platform, and verify the OS build number after installation. No workaround is practical for a kernel use-after-free, so patching is the primary mitigation; prioritize multi-user workstations, VDI hosts, and servers where low-privileged users or local code execution occur. Track Microsoft advisories for updates on exploitation status, since only two zero-days were reported as exploited in this Patch Tuesday cycle and this flaw is not confirmed among them.