CVE-2026-84009 Microsoft CVE debrief

Who should care

Defenders of Windows systems, especially those with high-risk exposure, should assess and prioritize patching for CVE-2026-84009. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for

Why it matters

CVE-2026-84009 is a medium-severity vulnerability in Windows Projected File System that allows authorized local tampering. Defenders should prioritize patching, especially for high-risk systems.

• Local tampering by authorized attackers
• Potential for privilege escalation
• Data integrity risks in affected systems

Technical summary

A time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally. This vulnerability affects multiple Windows versions, including Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 23H2, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows 11 Version 26H2, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025, and Windows Server 2025 (Server Core installation).

Defensive priority

Apply patches for CVE-2026-84009 immediately, especially for systems with high-risk exposure.

Recommended defensive actions

• Apply patches for CVE-2026-84009
• Inventory affected Windows systems
• Verify patch application

Evidence notes

The CVE record and Microsoft's advisory provide details on the vulnerability and affected systems. The CVE record was published on 2026-10-13T18:59:59.473Z and has not been modified since then. The official CVE Program record and NIST NVD detail page provide additional information on the vulnerability. The source item details and Microsoft advisory also provide information on the affected systems and patches. The evidence is limited to publicly available information and may not be

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.