Windows Print Spooler: Elevation of privilege vulnerability

Summary

Weak authentication in Windows Print Spooler Components allows an authorized local attacker to elevate privileges. The attack is local only and requires the attacker to already have a foothold on the device, for example through a phished standard user account or malware. NVD and the CVE record rate it CVSS 7.8 (High), with high impact on confidentiality, integrity and availability if exploited.

Affected

• Windows 10 Version 1607 (builds below 10.0.14393.9612)
• Windows Server 2016 (builds below 10.0.14393.9612)
• Windows 10 Version 1809 (builds below 10.0.17763.9376)
• Windows 10 Version 21H2 (builds below 10.0.19044.7807)
• Windows 10 Version 22H2 (builds below 10.0.19045.7807)
• Windows 11 Version 23H2 (builds below 10.0.22631.7652)
• Windows 11 Version 24H2 (builds below 10.0.26100.9711)
• Windows 11 Version 25H2 (builds below 10.0.26200.9711)
• Windows 11 Version 26H1 (builds below 10.0.28000.3231)
• Windows 11 Version 26H2 (builds below 10.0.26300.9711)
• Windows Server 2012 and 2012 R2 (builds below 6.2.9200.26434 and 6.3.9600.23470)

Fixed in

• Windows 10 1607 and Server 2016: build 10.0.14393.9612
• Other listed versions: see the affected builds above (fixed builds are the first builds not listed as affected)
• Update package: October 2026 cumulative update; Tenable maps KB5126868 to this CVE for Windows 10 1607 and Server 2016 (KB number not yet verified on MSRC)

Workaround

• No separate vendor workaround confirmed.
• Where the Print Spooler is not needed, stop and disable the Print Spooler service to remove the attack surface. On servers this may not be practical if printing is required.

Exploitation

• CISA SSVC data: exploitation 'none', automatable 'no'.
• Not listed in CISA's Known Exploited Vulnerabilities catalog (according to OpenCVE).
• VulDB states that no exploit is available.
• No public proof of concept found.

Our recommendation

• Inventory all Windows 10 1607 and Server 2016 hosts, and any other affected Windows builds.
• Install the October 2026 cumulative update via Windows Update or WSUS; verify the KB number on the MSRC advisory first.
• Disable the Print Spooler on servers and workstations that do not print.
• Check the Microsoft lifecycle status of Windows 10 1607 and Server 2016 and plan replacement if patching is no longer sufficient.
• Monitor for new exploit reports or a KEV listing and re-check after the next NVD update.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-85376 msrc.microsoft.com
• NVD record via Vulners vulners.com
• OpenCVE: CVE-2026-85376 app.opencve.io
• VulDB: CVE-2026-85376 vuldb.com
• Tenable plugin 365471 (update package reference) www.tenable.com
• Rapid7 record via Vulners vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:14.