Windows SSDP Service: Local privilege escalation

Summary

Microsoft has fixed a flaw in the Windows SSDP Discovery service (SSDPSRV) that allows a local user with low privileges to gain higher privileges on the system. The CVE record describes the problem as improper authentication, but the CWE is CWE-522 (Insufficiently Protected Credentials). The vector is local, so an attacker needs an existing foothold, for example through phishing or a compromised user account. CISA SSVC rates exploitation as none and the flaw as not automatable, and no public proof of concept was found.

Affected

• Windows 10 Version 1607, 1809, 21H2, 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1, 26H2
• Windows Server 2016, 2019 (including Server Core), 2022
• Windows Server 2025 is listed by a third-party aggregator only and is unverified.

Fixed in

• Fixed builds according to the CVE record: 10.0.14393.9688 (1607 / Server 2016), 10.0.17763.9487 (1809 / Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.28000.3501 (26H1), 10.0.26300.9974 (26H2), 10.0.20348.5870 (Server 2022)
• KB numbers from third-party sites are unverified. Check the MSRC advisory.
• Unknown: the Microsoft advisory could not be retrieved for this entry.

Workaround

• Disable the SSDP Discovery service on systems that do not need UPnP: Set-Service -Name SSDPSRV -StartupType Disabled
• Side effect: SSDP-based devices are no longer discovered. Test before rollout.
• No Microsoft-published workaround specific to this CVE is known.

Exploitation

• No known exploitation in the wild (CISA SSVC: Exploitation none, Automatable no).
• No public proof of concept found.
• The CVSS exploit maturity is E:U (unproven).

Our recommendation

• Install the November 2026 cumulative updates on all affected systems. Verify the exact builds and KB numbers in the MSRC advisory first.
• Disable SSDPSRV on servers and workstations that do not require UPnP.
• Limit local logon rights on shared and kiosk machines.
• Identify endpoints on unsupported builds (for example Windows 10 1607 or 1809) and check their ESU options or plan an upgrade.
• Monitor for unusual local privilege changes on endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85907 msrc.microsoft.com
• CVE Record CVE-2026-85907 (CVE.org) www.cve.org
• Strix: CVE-2026-85907 (third-party, unverified) www.strix.ai
• Senserva KB 5131080 (third-party, unverified) senserva.com
• Senserva KB 5131090 (third-party, unverified) senserva.com
• Senserva KB 5131085 (third-party, unverified) senserva.com
• CIS Intune Windows 11 audit item (SSDPSRV hardening) www.tenable.com
• Disable SSDPSRV hardening guide github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:13.