CVE-2026-85916
Status: AnalyzedMedium (5.5)—
Severity5.5Medium · CVSS 3.1
Exploitation probability0.43 %higher than 35% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.
CVSS
- Base score
- 5.5
- Version
- 3.1
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.43 %
- Percentile among all scored CVEs
- 35
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1068Exploitation for Privilege Escalationprivilege escalation70 % - Primary impact
T1005Data from Local Systemcollection60 %
El vector AV:L/PR:N/UI:N indica explotación local sin privilegios (T1068); la descripción (CWE-359) habla de divulgación de información personal privada, sin mencionar credenciales.
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
ATT&CK mitigations that cover these techniques
Affected technologies (6)
CWEs
- CWE-359
References
Show 1 references
Raw JSON (NVD)
Show
{
"id": "CVE-2026-85916",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-85916",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-10-13T20:03:36.386462Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.2,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 2.5
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "secure@microsoft.com",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Windows 11 version 23H2",
"versions": [
{
"status": "affected",
"version": "10.0.22631.0",
"lessThan": "10.0.22631.7652",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 11 Version 23H2",
"versions": [
{
"status": "affected",
"version": "10.0.22631.0",
"lessThan": "10.0.22631.7652",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 11 Version 24H2",
"versions": [
{
"status": "affected",
"version": "10.0.26100.0",
"lessThan": "10.0.26100.9711",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 11 Version 25H2",
"versions": [
{
"status": "affected",
"version": "10.0.26200.0",
"lessThan": "10.0.26200.9711",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 11 version 26H1",
"versions": [
{
"status": "affected",
"version": "10.0.28000.0",
"lessThan": "10.0.28000.3231",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 11 Version 26H2",
"versions": [
{
"status": "affected",
"version": "10.0.26300.0",
"lessThan": "10.0.26300.9711",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2025",
"versions": [
{
"status": "affected",
"version": "10.0.26100.0",
"lessThan": "10.0.26100.33650",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2025 (Server Core installation)",
"versions": [
{
"status": "affected",
"version": "10.0.26100.0",
"lessThan": "10.0.26100.33650",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
}
]
}
],
"published": "2026-10-13T19:21:17.827",
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85916",
"tags": [
"Vendor Advisory"
],
"source": "secure@microsoft.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"description": [
{
"lang": "en",
"value": "CWE-359"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally."
}
],
"lastModified": "2026-10-16T18:01:13.570",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*",
"vulnerable": true,
"matchCriteriaId": "C31937C6-EFB5-4325-9F94-0F356B164035",
"versionEndExcluding": "10.0.22631.7652"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "AAC3F2E7-6713-4BE0-9DAA-59310B4C3863",
"versionEndExcluding": "10.0.22631.7652"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*",
"vulnerable": true,
"matchCriteriaId": "E2A85326-7BE4-4F2C-AF37-45FD4B939D07",
"versionEndExcluding": "10.0.26100.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "03291588-C7D5-445C-AD9F-03D3ADE6BE8A",
"versionEndExcluding": "10.0.26100.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*",
"vulnerable": true,
"matchCriteriaId": "5E5700DF-EF80-4D08-9B32-E0481EAE8147",
"versionEndExcluding": "10.0.26200.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "BA7D90B4-6AD5-4EF9-8709-01E4CED31779",
"versionEndExcluding": "10.0.26200.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*",
"vulnerable": true,
"matchCriteriaId": "EC0260C7-D6B6-487F-B304-CAAE72608BF7",
"versionEndExcluding": "10.0.28000.3231"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "8DA3AD5D-32C0-4AC9-A856-512106D42CC7",
"versionEndExcluding": "10.0.28000.3231"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:arm64:*",
"vulnerable": true,
"matchCriteriaId": "8D5DCA1A-EF56-43AF-B079-011AE5C2F846",
"versionEndExcluding": "10.0.26300.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "38D4479B-ACB0-4DC7-A4B1-F448C5B2EBD8",
"versionEndExcluding": "10.0.26300.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "D95E80FE-F34C-4805-9A66-75D090E65BBB",
"versionEndExcluding": "10.0.26100.33650"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secure@microsoft.com"
}