CVE-2026-85375 Microsoft CVE debrief

Who should care

Defenders responsible for Windows systems, especially those exposed to local attacks, should prioritize patching this vulnerability. Defenders should prioritize patching this vulnerability, especially for systems exposed to local attacks. This vulnerability affects Windows systems, particularly those with Universal Plug and Play (UPnP) Device Host enabled. Security teams and vulnerability management teams should be

Why it matters

CVE-2026-85375 is a high-severity elevation of privilege vulnerability in Windows Universal Plug and Play (UPnP) Device Host. Defenders should prioritize patching and monitoring systems for potential exploitation attempts.

• Local privilege escalation is possible, allowing attackers to gain elevated privileges.
• Patching is necessary to prevent exploitation.
• Monitoring for exploitation attempts is recommended.
• Verification of system exposure and vulnerability status is required.

Technical summary

The vulnerability exists in the Windows Universal Plug and Play (UPnP) Device Host and allows an authorized attacker to elevate privileges locally. The vulnerability has a CVSS score of 7.8 and is considered high severity. This vulnerability is a high-severity elevation of privilege vulnerability in Windows Universal Plug and Play (UPnP) Device Host. An authorized attacker can exploit this vulnerability locally to gain elevated privileges.

Defensive priority

Defenders should prioritize patching this vulnerability, especially for systems exposed to local attacks.

Recommended defensive actions

• Patch vulnerable systems immediately, especially those exposed to local attacks.
• Verify and apply the latest security updates from Microsoft.
• Monitor systems for potential exploitation attempts.

Evidence notes

The CVE record and source item provide details on the vulnerability, but do not specify if exploitation has occurred or what the exact impact is. There is no information on known or unknown affected scope. Defenders should verify system exposure and vulnerability status. The CVE record was published on 2026-10-13T19:00:04.569Z and has not been modified since then. The source item provides details on the vulnerability. Official CVE Program record with source-provided CVE metadata and N

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.