CVE-2026-96183
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Missing authentication for a critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally.
Risk Assessment
An attacker with local access can invoke a critical service function without authentication and obtain sensitive system information.
Recommendation
Install the latest Windows updates containing the fix for this service. Restrict local system access to trusted users only.
Other vulnerabilities in Windows Health and Optimized Experiences Service
See all- CVE-2026-85884High
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.
- CVE-2025-59241High
Improper link resolution before file access ('link following') exists in Windows Health and Optimized Experiences Service. An authorized attacker can exploit this to elevate privileges locally.
Original NVD description (English source)
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS