Microsoft Windows 11: Elevation of privilege in Health and Optimized Experiences

Summary

A missing authentication check for a critical function in the Windows Health and Optimized Experiences Service allows an authorized local user to elevate privileges. Successful exploitation can give an attacker high impact on confidentiality, integrity and availability of the system. Microsoft classes the attack as local with low privileges required, so an attacker first needs a foothold such as a logged-in account or malware. A public proof-of-concept has been reported, so unpatched systems should be prioritised.

Affected

• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711

Fixed in

• October 2026 cumulative security update for the listed builds (OS builds 26100.9711, 26200.9711, 26300.9711 and 28000.3231 for 26H1).
• Third-party sources name KB5127648 for this update; confirm the KB number on the MSRC advisory.

Workaround

• No workaround is needed where the update can be installed.
• If patching is not possible, one source advises disabling the Windows Health and Optimized Experiences Service. Microsoft guidance was not found, and side effects are unknown, so test first.

Exploitation

• Public proof-of-concept code has been reported on GitHub (not verified by us).
• No confirmed in-the-wild exploitation found.
• CISA SSVC: exploitation none, not automatable. Not listed in the CISA KEV catalogue.

Our recommendation

• Install the October 2026 cumulative update on all affected Windows 11 systems as a priority.
• Windows 11 24H2 Home and Pro receive no further updates after this build; upgrade these devices to a supported version.
• Identify affected devices, especially shared workstations and terminal servers.
• Restrict local accounts, limit untrusted code execution and monitor for unusual privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Beardhammer/CVE-2026-85884

Research sources

• MSRC Security Update Guide msrc.microsoft.com
• OpenCVE app.opencve.io
• Vulners/NVD mirror vulners.com
• NinjaOne KB5127648 www.ninjaone.com
• Pureinfotech KB5127648 build list pureinfotech.com
• Digital Citizen: Windows 11 24H2 end of updates www.digitalcitizen.life
• Alessandro Leonov: October 2026 Patch Tuesday avleonov.com
• ACN (Italy) monthly Microsoft updates www.acn.gov.it

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:47.