CVE-2026-85790
Status: AnalyzedMedium (5.9)—
Severity5.9Medium · CVSS 3.1
Exploitation probability0.69 %higher than 52% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVSS
- Base score
- 5.9
- Version
- 3.1
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.69 %
- Percentile among all scored CVEs
- 52
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1190Exploit Public-Facing Applicationinitial access90 % - Primary impact
T1005Data from Local Systemcollection45 %
El vector AV:N/PR:N/UI:N indica explotación remota sin privilegios; la descripción dice que permite divulgar información por red, sin mencionar ejecución de comandos, por lo que T1059 no se sustenta.
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
ATT&CK mitigations that cover these techniques
Affected technologies (10)
CWEs
- CWE-416
References
Show 1 references
Raw JSON (NVD)
Show
{
"id": "CVE-2026-85790",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-85790",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-10-13T20:11:44.145371Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.9,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 2.2
}
]
},
"affected": [
{
"source": "secure@microsoft.com",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Microsoft Visual Studio 2022 version 17.14",
"versions": [
{
"status": "affected",
"version": "17.14.0",
"lessThan": "17.14.42",
"versionType": "custom"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Visual Studio 2026 version 18.10",
"versions": [
{
"status": "affected",
"version": "18.10.0",
"lessThan": "18.10.4",
"versionType": "custom"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft.Native.Quic.MsQuic.Schannel",
"versions": [
{
"status": "affected",
"version": "1.9.0",
"lessThan": "2.6.2",
"versionType": "custom"
}
],
"platforms": [
".NET 10.0 installed on Windows",
".NET 11.0 installed on Windows",
".NET 8.0 installed on Windows",
".NET 9.0 installed on Windows"
]
},
{
"vendor": "Microsoft",
"product": "Windows 11 version 23H2",
"versions": [
{
"status": "affected",
"version": "10.0.22631.0",
"lessThan": "10.0.22631.7652",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 11 Version 23H2",
"versions": [
{
"status": "affected",
"version": "10.0.22631.0",
"lessThan": "10.0.22631.7652",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 11 Version 24H2",
"versions": [
{
"status": "affected",
"version": "10.0.26100.0",
"lessThan": "10.0.26100.9711",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 11 Version 25H2",
"versions": [
{
"status": "affected",
"version": "10.0.26200.0",
"lessThan": "10.0.26200.9711",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 11 version 26H1",
"versions": [
{
"status": "affected",
"version": "10.0.28000.0",
"lessThan": "10.0.28000.3231",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 11 Version 26H2",
"versions": [
{
"status": "affected",
"version": "10.0.26300.0",
"lessThan": "10.0.26300.9711",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2022",
"versions": [
{
"status": "affected",
"version": "10.0.20348.0",
"lessThan": "10.0.20348.5761",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2025",
"versions": [
{
"status": "affected",
"version": "10.0.26100.0",
"lessThan": "10.0.26100.33650",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2025 (Server Core installation)",
"versions": [
{
"status": "affected",
"version": "10.0.26100.0",
"lessThan": "10.0.26100.33650",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
}
]
}
],
"published": "2026-10-13T19:21:02.243",
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85790",
"tags": [
"Vendor Advisory",
"Patch"
],
"source": "secure@microsoft.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network."
}
],
"lastModified": "2026-10-16T18:43:27.480",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*",
"vulnerable": true,
"matchCriteriaId": "C31937C6-EFB5-4325-9F94-0F356B164035",
"versionEndExcluding": "10.0.22631.7652"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "AAC3F2E7-6713-4BE0-9DAA-59310B4C3863",
"versionEndExcluding": "10.0.22631.7652"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*",
"vulnerable": true,
"matchCriteriaId": "E2A85326-7BE4-4F2C-AF37-45FD4B939D07",
"versionEndExcluding": "10.0.26100.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "03291588-C7D5-445C-AD9F-03D3ADE6BE8A",
"versionEndExcluding": "10.0.26100.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*",
"vulnerable": true,
"matchCriteriaId": "5E5700DF-EF80-4D08-9B32-E0481EAE8147",
"versionEndExcluding": "10.0.26200.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "BA7D90B4-6AD5-4EF9-8709-01E4CED31779",
"versionEndExcluding": "10.0.26200.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*",
"vulnerable": true,
"matchCriteriaId": "EC0260C7-D6B6-487F-B304-CAAE72608BF7",
"versionEndExcluding": "10.0.28000.3231"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "8DA3AD5D-32C0-4AC9-A856-512106D42CC7",
"versionEndExcluding": "10.0.28000.3231"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:arm64:*",
"vulnerable": true,
"matchCriteriaId": "8D5DCA1A-EF56-43AF-B079-011AE5C2F846",
"versionEndExcluding": "10.0.26300.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "38D4479B-ACB0-4DC7-A4B1-F448C5B2EBD8",
"versionEndExcluding": "10.0.26300.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "A98E694F-9390-488A-A7FB-3E7BF7E988F8",
"versionEndExcluding": "10.0.20348.5761"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "D95E80FE-F34C-4805-9A66-75D090E65BBB",
"versionEndExcluding": "10.0.26100.33650"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:native.quic.msquic.schannel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "37D98B65-3CCB-404D-9801-E0CCF83EE479",
"versionEndExcluding": "2.6.2"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:.net:8.0.0:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "ECB25C50-5246-435F-B5C6-C4643ADBEC47"
},
{
"criteria": "cpe:2.3:a:microsoft:.net:9.0.0:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5DFE5320-88E8-42C2-BC1C-E402FE71ECBB"
},
{
"criteria": "cpe:2.3:a:microsoft:.net:10.0.0:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "76C7D6DE-4773-4BB0-9127-75503DFCB81F"
},
{
"criteria": "cpe:2.3:a:microsoft:.net:11.0.0:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6A047E1A-AE43-4947-B93C-F99B0CFFBF34"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B00B9460-AB1D-430A-A391-C93BC85BE361",
"versionEndExcluding": "17.14.42",
"versionStartIncluding": "17.14.0"
},
{
"criteria": "cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC1612A3-E118-4BAB-A4F7-A9C2736A9855",
"versionEndExcluding": "18.10.4",
"versionStartIncluding": "18.10.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secure@microsoft.com"
}