CVE-2026-85921Patch(microsoft / windows_11_26h1)

HIGHCVSS 8.2 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch microsoft windows_11_26h1 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts

Recommended action window: Immediate (within 24h)

NVD description

Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

microsoft CVEs Back to dashboard

6.0/ 10 priority

Sources & remediation

Patch / fix

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85921

Weakness type (CWE)

CWE-415

Priority

HIGH

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_11_26h1

Threat summary

Active exploitation appears in 1 classified signals
Exploit tooling references are present in monitored signal
Patch or workaround signal is available
4 mentions across 3 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 1 signal
Patch or workaround mentioned in 4 signals
Technical details provided in 3 signals
Peaked 1d ago at 2 mentions (2026-09-18); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

microsoft

Products

windows_11_26h1

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Patch

375.0%

Active Exploitation

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-15	1	Patch1
2026-09-18	2	Active Exploitation1Patch1
2026-09-19	1	Patch1

Full discourse4 posts

Rıdvan Yağlı@ridvanyagli46d
Patch
🚨 Windows 11 26H1'de Yüksek seviyeli LPE açığı! CVE-2026-85921 — Windows Secure Kernel Mode'da bulunan Double-Free (CWE-415) güvenlik açığı, yerel olarak yetkili bir saldırganın ayrıcalıklarını yükseltmesine neden olabiliyor. 🔴 CVSS: 8.2 (High) 🎯 Saldırı: Local / LPE 💻 Etkilenen: Windows 11 26H1 (x64/ARM64) ⚠️ Etkilenen sürümler: 10.0.28000.0 – 10.0.28000.2955 ✅ Yamalı sürüm: 10.0.28000.2956 📅 Yama: 14 Eylül 2026'da yamalandı. Microsoft tarafından yayınlanan güncellemeyi mutlaka uygulayın. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85921
Post summary
The post describes CVE-2026-85921 as a high-severity Windows Secure Kernel Mode local privilege escalation vulnerability and explicitly highlights the patched version and Microsoft update. The primary actionable takeaway is to apply the available patch.
00030477
2.5K followersView on X
Windows Forum@windowsforum42d
Patch
☁️ Microsoft fixed 18 Azure/Copilot flaws server-side—no tenant patch needed. But CVE-2026-85921 still needs Windows Updates. Cloud admins relax; endpoint admins get Patch Tuesday homework. https://windowsforum.com/news/cve-2026-85921-requires-windows-updates-not-azure-patches.445053/?utm_source=x&utm_medium=social&utm_campaign=news_node4 #MicrosoftCopilot #AzureSecurity #CloudVulnerabilities #WindowsCve https://t.co/WAosc7cHNb
Post summary
The tweet emphasizes that Microsoft fixed 18 Azure/Copilot flaws server-side without tenant patching, but CVE-2026-85921 still requires Windows Updates, making patching the main takeaway.
0000060
1.4K followersView on X
SecureChap@SecureChap43d
Active Exploitation
An unauthenticated attacker could have seized control of Azure AI Foundry with a single CVSS 10 flaw that Microsoft fixed server-side with no customer steps required. CVE-2026-85889 stemmed from missing authentication on a critical function, letting any network caller escalate without credentials. The September 18 2026 advisory listed no observed exploitation. CVE-2026-85885 allowed command injection in Microsoft 365 Copilot via an authorized network path. CVE-2026-85878 bypassed authorization checks in Azure Database for PostgreSQL. CVE-2026-87701 failed to neutralize input in Azure Cosmos DB. All three carried CVSS 9.9 scores and were already mitigated server-side. CVE-2026-62721 gave SYSTEM to a local attacker in Windows User-Mode Power Service because access control checks lacked granularity. The September 2026 Cumulative Update KB5129194 shipped build 28000.2956 for Windows 11 26H1 on arm64 and x64. CVE-2026-85921 triggered a double free in Windows Secure Kernel Mode on the same out-of-band package, enabling elevation to VTL1. Microsoft addressed 974 vulnerabilities that week. An actively exploited ALPC flaw was chained with two Chrome bugs into the BlueMoon kit used by targeted actors. Defenders should verify the latest cumulative updates are applied across Windows and Azure workloads.
Post summary
The text reports multiple vulnerabilities with detailed technical context, confirms active exploitation via the BlueMoon kit, and highlights Microsoft's server-side patches. The primary focus is on real-world exploitation and associated exploit tooling.
00000108
172 followersView on X
Cybersecurity News Everyday@TweetThreatNews43d
Patch
Microsoft patched 18 flaws in Azure and Copilot products, mostly elevation of privilege bugs, plus info disclosure issues. No active exploitation known; fixes were server-side except Windows users need CVE-2026-85921. #Azure #Copilot #Microsoft https://www.hendryadrian.com/microsoft-patches-18-vulnerabilities-in-ai-cloud-products/
Post summary
The text focuses on Microsoft patching multiple vulnerabilities in Azure and Copilot products, highlighting that fixes are mostly server-side except for one CVE requiring Windows user action, with no known active exploitation.
00000279
4.8K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_11_26h1	-	-	arm64
OS	microsoft	windows_11_26h1	-	-	x64

Explore more

Back to dashboard microsoft CVEs windows_11_26h1 vulnerabilities

What researchers are saying

CVE-2026-85921

Rıdvan Yağlı[verified]@ridvanyagliPatch

The post describes CVE-2026-85921 as a high-severity Windows Secure Kernel Mode local privilege escalation vulnerability and explicitly highlights the patched version and Microsoft update. The primary actionable takeaway is to apply the available patch.

Windows Forum[verified]@windowsforumPatch

The tweet emphasizes that Microsoft fixed 18 Azure/Copilot flaws server-side without tenant patching, but CVE-2026-85921 still requires Windows Updates, making patching the main takeaway.

SecureChap[verified]@SecureChapActive Exploitation

The text reports multiple vulnerabilities with detailed technical context, confirms active exploitation via the BlueMoon kit, and highlights Microsoft's server-side patches. The primary focus is on real-world exploitation and associated exploit tooling.

Cybersecurity News Everyday[verified]@TweetThreatNewsPatch

The text focuses on Microsoft patching multiple vulnerabilities in Azure and Copilot products, highlighting that fixes are mostly server-side except for one CVE requiring Windows user action, with no known active exploitation.