CVE-2026-85360 Overview
CVE-2026-85360 is a use-after-free vulnerability [CWE-416] in the Microsoft Windows Kernel. An authorized local attacker can exploit the flaw to elevate privileges on affected systems. The issue impacts a broad range of Windows client and server releases, including Windows 10, Windows 11, and Windows Server editions from 2012 through 2025.
Successful exploitation gives the attacker higher-integrity execution in kernel context, which can bypass user-mode security boundaries and enable persistence. Microsoft published the advisory in its Security Update Guide, and the vulnerability affects both x86, x64, and ARM64 architectures where supported.
Critical Impact
A low-privileged local user can escalate to SYSTEM by triggering a freed kernel object, gaining full control over the affected Windows host.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2) — x86, x64, ARM64 where applicable
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) — x64 and ARM64
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-09-08 - CVE-2026-85360 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-85360
Vulnerability Analysis
The flaw is a use-after-free condition within the Windows Kernel. The kernel retains or dereferences a pointer to an object after it has been freed, allowing the memory contents to be reused for attacker-influenced data. When the stale pointer is subsequently accessed, the kernel operates on attacker-controlled structure fields.
Exploitation is local and requires an authenticated user context, but no user interaction is needed. Attack complexity is high because the attacker must win a timing or state-transition window to place a controlled object in the freed slot before the dangling reference is used. Successful exploitation compromises confidentiality, integrity, and availability at the kernel level.
Root Cause
The root cause is improper lifetime management of a kernel object [CWE-416]. A reference to the object is used after the object has been released back to the pool allocator, and the missing synchronization or reference-count update allows the reallocated memory to be reinterpreted with attacker-controlled contents.
Attack Vector
An attacker with local, low-privileged access issues a sequence of system calls that triggers the free of the kernel object while retaining a usable reference. The attacker then sprays the pool with controlled objects of matching size to occupy the freed slot. When the kernel dereferences the stale pointer, the attacker gains write-what-where or control-flow primitives that lead to SYSTEM-level code execution.
No public proof-of-concept exploit or CISA KEV listing exists at the time of publication. Refer to the Microsoft CVE-2026-85360 Update Guide for vendor-specific technical details.
Detection Methods for CVE-2026-85360
Indicators of Compromise
- Unexpected SYSTEM-level processes spawned from user sessions or low-integrity parents
- Kernel bugchecks (BSOD) referencing pool corruption, BAD_POOL_CALLER, or KERNEL_MODE_HEAP_CORRUPTION on otherwise stable hosts
- Creation or loading of unsigned drivers immediately following anomalous local process activity
- Repeated invocations of the same syscall sequence from a non-administrative user in a short window
Detection Strategies
- Monitor for privilege token elevation events where a process token transitions to SYSTEM without a corresponding legitimate parent (services.exe, wininit.exe)
- Correlate kernel crash dumps with pool tag analysis to identify UAF patterns in kernel components
- Deploy behavioral endpoint detection to identify local privilege escalation chains, including suspicious handle duplication and abnormal NtCreate* sequences
Monitoring Recommendations
- Enable Windows Event Log auditing for process creation (Event ID 4688) with command-line capture and token elevation events (Event ID 4672)
- Forward kernel minidumps and Windows Error Reporting telemetry to a centralized SIEM for pool-corruption pattern analysis
- Baseline driver loads using Sysmon Event ID 6 and alert on unsigned or newly observed kernel drivers
How to Mitigate CVE-2026-85360
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-85360 to all affected Windows client and server systems
- Prioritize patching multi-user hosts, jump servers, and Remote Desktop hosts where low-privileged accounts operate
- Restrict local logon rights and remove unnecessary interactive users from sensitive systems until patched
- Verify patch deployment through Windows Update, WSUS, or your endpoint management platform and confirm reboot completion
Patch Information
Microsoft has released a security update addressing CVE-2026-85360 across all supported Windows versions listed in the advisory. Consult the Microsoft CVE-2026-85360 Update Guide for the specific KB article, build numbers, and cumulative update mapping for each affected SKU.
Workarounds
- No official vendor workaround is published; apply the security update as the primary remediation
- Where patching must be delayed, enforce least-privilege access and remove local administrator rights from standard users to reduce the attack surface
- Enable Hypervisor-Protected Code Integrity (HVCI) and Virtualization-Based Security (VBS) to raise the difficulty of kernel exploitation
# Verify installed updates and enabled kernel protections on Windows
wmic qfe list brief /format:table
Get-CimInstance -ClassName Win32_DeviceGuard | Select-Object SecurityServicesRunning, VirtualizationBasedSecurityStatus
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
