Microsoft Windows Management Services: Local privilege escalation via use after free
Summary
A use-after-free flaw (CWE-416) in the Windows Management Services component allows a local attacker with low privileges to elevate their rights on the affected system. The attacker needs an existing foothold on the machine, for example through phishing, stolen credentials or a local user account. Exploitation is not known and Microsoft rates it as less likely; the issue is mainly relevant on multi-user systems and terminal servers.
Affected
- Windows 11 version 23H2 before 10.0.22631.7652
- Windows 11 version 24H2 before 10.0.26100.9711
- Windows 11 version 25H2 before 10.0.26200.9711
- Windows 11 version 26H1 before 10.0.28000.3231
- Windows 11 version 26H2 before 10.0.26300.9711
- Windows Server 2025 (including Server Core) before 10.0.26100.33650
Fixed in
- October 2026 security updates from Microsoft for the affected versions (reported as KB5126653 for Windows 11 23H2 and KB5126646 for Windows Server 2025; verify on the MSRC page before rollout)
Workaround
Unknown.
Exploitation
- Publicly disclosed: No
- Exploited in the wild: No
- Microsoft exploitability assessment: Exploitation Less Likely
- Not listed in CISA KEV at the time of research
- EPSS: 0.00245
Our recommendation
- Install the October 2026 security updates on all affected Windows 11 and Windows Server 2025 systems in the normal patch cycle, prioritising multi-user machines, RDP and terminal servers.
- Check your Windows builds against the affected version list above.
- Restrict local logon and limit local administrator accounts to reduce the risk of a foothold.
- Monitor for unexpected privilege changes and re-check the MSRC advisory and CISA KEV for changes.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-87691 msrc.microsoft.com
- Vulners MS:CVE-2026-87691 vulners.com
- OpenCVE CVE-2026-87691 app.opencve.io
- Vulnrichment CVE-2026-87691 vulners.com
- Strix CVE-2026-87691 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:40.
Original description (NVD)
Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.