Microsoft Windows BITS: Elevation of privilege via uninitialized resource

Summary

A local elevation of privilege vulnerability (CWE-908, Use of Uninitialized Resource) exists in the Windows Background Intelligent Transfer Service (BITS). An authorized, low-privileged local attacker can gain higher privileges on the affected system, with a CVSS v3.1 base score of 7.8 (High). The vulnerability is not remotely exploitable, so the main risk is a valid low-privilege account or malware already running on a workstation or server.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (6.2.9200.0 before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (6.3.9600.0 before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 before 10.0.14393.9612)

Fixed in

• Fixed builds per the official CVE record: Windows 10 1607 and Server 2016 10.0.14393.9612; Windows 10 1809 10.0.17763.9376; Windows 10 21H2 10.0.19044.7807; Windows 10 22H2 10.0.19045.7807; Windows 11 23H2 10.0.22631.7652; Windows 11 24H2 and 25H2 and 26H2 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711; Windows 11 26H1 10.0.28000.3231; Server 2012 6.2.9200.26434; Server 2012 R2 6.3.9600.23470.
• The KB article number for Windows 10 1607 and Server 2016 is unknown. Check the MSRC Security Update Guide for the complete table.

Workaround

Unknown. No vendor workaround has been identified. The following general measures are not from the vendor: restrict local logon on shared or multi-user systems and isolate or upgrade Windows 10 1607 hosts.

Exploitation

• Exploited in the wild: no evidence found. No CISA KEV listing identified.
• Public proof of concept: none found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Microsoft exploit code maturity: Unproven (E:U).
• EPSS: about 0.37%.

Our recommendation

• Install the October 2026 Microsoft security update on all affected systems, prioritising servers, terminal servers, file servers and multi-user systems.
• Identify remaining Windows 10 1607 and LTSB 2016 hosts. Verify the end-of-support date and whether Extended Security Updates are available, because these systems may receive no further fixes. Isolate them or plan an upgrade.
• Review local accounts and restrict interactive logon on shared systems.
• Confirm the 1607 KB number on the MSRC page before rollout and recheck the NVD status before finalising this entry.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft MSRC Security Update Guide: CVE-2026-85843 msrc.microsoft.com
• Vulners MSCVE: MS:CVE-2026-85843 vulners.com
• Vulners NVD: CVE-2026-85843 vulners.com
• Vulners VulnCheck/Vulnrichment: CVE-2026-85843 vulners.com
• OpenCVE: CVE-2026-85843 app.opencve.io
• Qualys: Microsoft Patch Tuesday October 2026 review blog.qualys.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:01.