Description
Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
Published: 2026-10-13
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Patch Immediately
AI Analysis

Impact

The vulnerability is a use‑after‑free flaw in the Windows Update Orchestrator Service that can be triggered by an authorized local attacker to gain elevated privileges. It is classified as CWE‑416 (Use After Free).

Affected Systems

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1 and Windows Server 2025 (including Server Core) are affected.

Risk and Exploitability

The CVSS score of 7 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is local: an attacker who can run authorized code on the system can exploit the service to elevate to higher privileges.

Generated by OpenCVE AI on October 17, 2026 at 00:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Windows Update and install any available patches for Windows 11 versions 23H2 through 26H2 and Windows Server 2025 before the update is deployed
  • If possible, temporarily disable the Windows Update Orchestrator Service to prevent exploitation until a patch is applied
  • Apply least‑privilege controls so that only authorized administrators can trigger or interact with the Windows Update Orchestrator Service

Generated by OpenCVE AI on October 17, 2026 at 00:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 25 Oct 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows Server 2025 (server Core Installation)

Wed, 21 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 26h2
CPEs cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*
Vendors & Products Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 26h2

Tue, 13 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
Title Windows Update Orchestrator Service Elevation of Privilege Vulnerability
First Time appeared Microsoft
Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 Version 26h2 For Arm64-based Systems
Microsoft windows Server 2025
Weaknesses CWE-416
CPEs cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 Version 26h2 For Arm64-based Systems
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Windows 11 23h2 Windows 11 23h2 Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 Windows 11 25h2 Windows 11 26h1 Windows 11 26h1 Windows 11 26h2 Windows 11 Version 26h2 For Arm64-based Systems Windows Server 2025 Windows Server 2025 (server Core Installation)
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-31T18:03:49.995Z

Reserved: 2026-08-31T23:21:53.299Z

Link: CVE-2026-83886

cve-icon Vulnrichment

Updated: 2026-10-13T20:21:05.536Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T19:20:39.427

Modified: 2026-10-21T13:14:52.763

Link: CVE-2026-83886

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-25T09:00:11Z

Weaknesses