Windows Storage VSP Driver: Use-after-free leads to local privilege escalation

Summary

A use-after-free flaw in the Windows Storage VSP Driver, a kernel-level Windows storage component, allows an attacker who is already authorised on the system to elevate their privileges locally. The attack is local only and is not reachable from the internet. The main risk is privilege escalation after an attacker has gained a foothold, for example through phishing or a compromised low-privilege account.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Windows Server 2016, including Server Core (10.0.14393.0 to below 10.0.14393.9612)
• Other Windows 10, Windows 11 and Windows Server versions are listed in the CVE record, including Windows 10 1809 and 22H2, Windows 11 23H2 to 26H2 and Windows Server 2019 and 2022.

Fixed in

• Windows 10 1607 and Windows Server 2016: 10.0.14393.9612 (fixed build shown on the MSRC listing; KB5126868 is from secondary sources, confirm on MSRC)
• Other fixed builds come from a third-party source and are not verified: Windows 10 1809 and Server 2019 at 10.0.17763.9376, Server 2022 at 10.0.20348.5761. Verify all builds on MSRC.

Workaround

Unknown. No vendor workaround was found; the security update is the fix.

• Until patched, limit local logon and shell access on affected systems (own recommendation, not from a vendor source).

Exploitation

• Microsoft lists the CVE as not exploited. CISA SSVC rates exploitation as none and automatable as no.
• Not in the CISA KEV catalogue at the time of research. No public proof of concept found.
• Unresolved: a Tenable plugin for the October 2026 bulletin flags an exploit as available, but this could not be tied to this CVE.

Our recommendation

• Patch Windows 10 1607 and Windows Server 2016 hosts with the October 2026 update as a priority, after confirming the KB and build on MSRC.
• Check whether each 1607 host still receives support or ESU updates; if not, plan a migration.
• Prioritise shared workstations, terminal or RDP servers and file servers.
• Restrict local logon and monitor for privilege escalation. Recheck MSRC and CISA KEV for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85872 msrc.microsoft.com
• Vulners NVD record CVE-2026-85872 vulners.com
• OpenCVE CVE-2026-85872 app.opencve.io
• Action1 Patch Tuesday October 2026 www.action1.com
• BaselineWatch Microsoft vulnerabilities baselinewatch.org
• Tenable plugin 365471 www.tenable.com
• Microsoft Q&A on Windows 10 1607 support status learn.microsoft.com
• Strix CVE-2026-85872 (third-party, unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:51.