Microsoft Windows 10 1607: Elevation of privilege via Python component

Summary

A Python component in Windows 10 Version 1607 contains an improper privilege management flaw that allows an authorized local user to elevate privileges. The attacker needs a valid low-privilege local account and no user interaction, so the flaw is not reachable from the internet. Microsoft's CVSS 3.1 score is 7.8 (High), and the impact is rated total on confidentiality, integrity and availability. Windows 10 1607 also loses regular security updates on 13 October 2026, so devices on this version remain exposed unless they are covered by ESU.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612), according to the CVE record and aggregators
• The CVE record also lists other Windows 10, Windows 11 and Windows Server versions; the MSRC Security Update Guide is authoritative
• Which Python component ships with Windows is unknown.

Fixed in

• Windows 10 Version 1607: build 10.0.14393.9612 or later, according to aggregators; verify in the MSRC table
• The current 1607 build 14393.9615 (ESU 2026-10 OOB) is above this value.

Workaround

• No vendor-specific workaround found.
• Generic measure: restrict user permissions to the minimum required for running Python scripts.
• Monitor Python execution logs for unusual privilege escalations.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Not listed in CISA KEV.
• No public exploit known.
• EPSS about 0.74%.

Our recommendation

• Install the latest cumulative update on all Windows 10 1607 devices while they are still supported, and verify that the build is 10.0.14393.9612 or later.
• Before 13 October 2026, check whether each 1607 device is covered by ESU; if not, plan migration to a supported Windows version.
• Limit local user accounts and admin rights, and monitor for unusual privilege escalation.
• Priority: high for remaining 1607 devices; medium for supported Windows versions after patching.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-85864 msrc.microsoft.com
• Vulners MSCVE: MS:CVE-2026-85864 vulners.com
• OpenCVE: CVE-2026-85864 app.opencve.io
• Panop Threat Heartbeat: CVE-2026-85864 panop.io
• Microsoft Windows release information learn.microsoft.com
• Microsoft Extended Security Updates www.microsoft.com
• Insentra: Windows 10 LTSB ending www.insentragroup.com
• WindowsForum: Windows 10 LTSB 2016 ESU plan windowsforum.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:53.