CVE-2026-83886

Cve.Mitre • October 14, 2026

Share: View original

Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.

CWE-416 : Use After Free

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

msrc.microsoft.com: Windows Update Orchestrator Service Elevation of Privilege Vulnerability external site vendor-advisory patch

Authorized Data Publishers

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Elevation of Privilege Vulnerabilities in Windows Disclosed On October 13, 2026, four elevation of privilege vulnerabilities were disclosed in Windows components, including CVE-2026-85908, CVE-2026-83785, CVE-2026-96858, and CVE-2026-83886. These vulnerabilities allow authorized attackers to elevate privileges locally through various attack vectors such as heap-based buffer overflow and use after free. The affected components include Windows Win32K, COM+ Event System Service, and Windows Security Account Manager. The CVEs have been assigned CVSS scores ranging from 5.5 to 7.8, indicating high severity. As of now, the status of these vulnerabilities remains unknown, and no patches have been confirmed to be released. Security professionals are advised to monitor for updates and apply patches as they become available. 4 sources 59

Extracted Entities

Companies (1)

CVEs (1)

CWE Weaknesses (1)

CWE-416 - Use After Free

Platforms (1)