CVE-2026-85791 Microsoft CVE debrief

Who should care

Defenders responsible for Windows systems, especially those with local access, should assess exposure and prioritize patching. This includes administrators, security teams, and IT personnel who manage Windows systems. They should verify system inventory for affected versions and monitor for suspicious local activity.

Why it matters

CVE-2026-85791 is a high-severity elevation of privilege vulnerability in Windows Encrypting File System (EFS). Defenders should prioritize patching vulnerable systems and monitor for suspicious local activity.

• Local privilege escalation is possible
• Patching vulnerable systems is a priority
• Verify system inventory for affected versions
• Monitor for suspicious local activity

Technical summary

The vulnerability is a heap-based buffer overflow in Windows Encrypting File System (EFS). An authorized attacker with local access can exploit this vulnerability to elevate privileges. The vulnerability affects multiple Windows versions, including Windows 10, Windows 11, and Windows Server. Defenders should prioritize patching vulnerable systems and monitor for suspicious local activity.

Defensive priority

Defenders should prioritize patching vulnerable Windows systems, especially those with local access.

Recommended defensive actions

• Patch vulnerable Windows systems, especially those with local access
• Verify system inventory for affected versions
• Monitor for suspicious local activity

Evidence notes

The CVE record and source item provide details on the vulnerability. However, additional information on exploitation and impact is limited. Defenders should verify system inventory for affected versions and monitor for suspicious local activity. The vulnerability affects multiple Windows versions, including Windows 10, Windows 11, and Windows Server. There is no indication of exploitation in the wild, but defenders should prioritize patching vulnerable systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.