Windows Performance Monitor: Code injection allows local privilege escalation

Summary

Windows Performance Monitor contains a code injection flaw (CWE-94) that allows an authorized local user to elevate privileges. The attack requires a valid local low-privilege account and no user interaction, and the CVSS score is 7.8 (High) with a high impact on confidentiality, integrity and availability. The affected versions include supported Windows 10, Windows 11, Windows Server 2012, 2012 R2 and 2016 builds, and Microsoft has published a security update.

Affected

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.0 to below 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019 (not listed in the official record; see research notes): 10.0.17763.0 to below 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to below 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to below 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to below 10.0.26300.9711
• Windows Server 2012 (including Server Core): 6.2.9200.0 to below 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to below 6.3.9600.23470

Fixed in

• Install the Microsoft security update for the affected build, with a build number at or above the thresholds listed under affected.
• Windows 10 1607 and Windows Server 2016: 10.0.14393.9612 or later. The KB number is unknown.
• Windows 10 1809 and Windows Server 2019: 10.0.17763.9376 or later (KB5126651 according to research notes).

Workaround

Unknown. No workaround was found in the reviewed sources. Check the Microsoft Security Update Guide for interim mitigations.

Exploitation

• CISA KEV: not listed.
• Public proof of concept: none found in the reviewed sources, which does not prove that none exists.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS 0.00745, a low predicted probability of exploitation.

Our recommendation

• Apply the October 2026 Microsoft security update through Windows Update or WSUS on all affected systems, prioritising shared, multi-user and RDS/terminal servers.
• Identify any Windows 10 1607 or Server 2016 systems and check their support status and whether Extended Security Updates apply before relying on the patch.
• Until patched, restrict local interactive logons to required users and monitor for unexpected elevated child processes.
• Verify the affected build ranges against the Microsoft Security Update Guide before rollout.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85359 msrc.microsoft.com
• NVD mirror data (Vulners) vulners.com
• OpenCVE: CVE-2026-85359 app.opencve.io
• Tenable plugin 365473 www.tenable.com
• Rapid7 EPSS data (Vulners) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:18.