CVE-2026-85884

Name of the Vulnerable Software and Affected Versions Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 version 26H1 Windows 11 Version 26H2

Description Missing authentication for a critical function in the Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally to SYSTEM. Low-privileged code with access to the Windows diagnostics workflow can trigger a trusted Event Tracing for Windows (ETW) event containing an attacker-controlled Lua module path. The whesvc service can then execute that module through WinDiag without properly validating the producer or restricting the module location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.