CVE-2026-85884
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.
Risk Assessment
An attacker could exploit missing authentication to elevate privileges, potentially leading to system control.
Recommendation
Install security updates and enable authentication for critical service functions.
Other vulnerabilities in Windows Health and Optimized Experiences Service
See all- CVE-2026-96183Medium
Missing authentication for a critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally.
- CVE-2025-59241High
Improper link resolution before file access ('link following') exists in Windows Health and Optimized Experiences Service. An authorized attacker can exploit this to elevate privileges locally.
Original NVD description (English source)
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS