IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Windows Update Orchestrator Service: Elevation of privilege via use after free

CVE-2026-83886High 7.0

← All vulnerabilities

Summary

The Windows Update Orchestrator Service in Windows 11 and Windows Server 2025 contains a use-after-free vulnerability (CWE-416). A local user with low privileges and some access to the system can exploit it under complex conditions to gain SYSTEM privileges. The attacker cannot reach the system remotely; the vulnerability is relevant mainly after an initial compromise, for example through phishing or malware.

Affected

  • Windows 11 version 23H2 (x64 and ARM64): below 10.0.22631.7652
  • Windows 11 version 24H2: below 10.0.26100.9711
  • Windows 11 version 25H2: below 10.0.26200.9711
  • Windows 11 version 26H1: below 10.0.28000.3231
  • Windows 11 version 26H2: below 10.0.26300.9711
  • Windows Server 2025 (including Server Core): below 10.0.26100.33650
  • Note: the CPE data lists only Windows 11 23H2; the advisory covers the products above.

Fixed in

  • Windows 11 23H2: 10.0.22631.7652 (KB5126653, according to third-party sources, to be verified)
  • Windows 11 24H2, 25H2, 26H2: 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711 (KB5127648, according to third-party sources, to be verified)
  • Windows 11 26H1: 10.0.28000.3231 (KB5127646, according to third-party sources, to be verified)
  • Windows Server 2025: 10.0.26100.33650 (KB5126646, according to third-party sources, to be verified)

Workaround

Unknown. Microsoft's advisory describes only a patch. No official Microsoft workaround has been identified.

Exploitation

  • Microsoft lists the vulnerability as not exploited at release.
  • CISA SSVC: Exploitation none, Automatable no, technical impact total.
  • Not listed in the CISA KEV catalog according to OpenCVE.
  • EPSS score about 0.3 percent.
  • No public proof of concept or exploit identified at the time of research.

Our recommendation

  • Install the October 2026 cumulative update for all affected Windows 11 and Windows Server 2025 systems as part of regular patching.
  • Verify the KB numbers and build numbers on the Microsoft Security Update Guide before rollout.
  • Prioritise multi-user systems, terminal or RDP servers and endpoints where untrusted local users may log on.
  • Check whether any systems run Windows 11 23H2 Home or Pro and confirm the end-of-service date on Microsoft's lifecycle page.
  • Monitor for public exploit code and for changes in exploitation status.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Elevation of privilege – Windows Update Orchestrator Service
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation more likely
Product family
Windows
Updates (KB)
KB5127648, KB5126646, KB5126653, KB5127646

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:03.

Original description (NVD)

Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed