Skip to main content
EVULNABLE
Home

CVE-2026-85803

Microsoft — Windows Camera Frame Server Monitor Elevation of Privilege Vulnerability

Patch Tuesday

Patch Tuesday

What EVULNABLE says

An EPSS probability of 0.003, and CVSS base score 7.0.

  • CISA KEV: did not apply
  • Ransomware: did not apply
  • Vendor exploitation: did not apply
  • EPSS: applied
  • Microsoft Exploitability Index: did not apply
  • Pre-patch disclosure: did not apply
  • KEV recency: did not apply
  • CVSS: applied

Monitor

The priority band answers “how soon”, not “how bad” — see Methodology for what it weighs and where it abstains.

The evidence behind it

MeasureValueSourceWhat it means
CVSS base score 7.0 — How severe the flaw is in itself. It does not say how likely an attack is.
FIRST EPSS 0.003 (15.5th pctl) FIRST FIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs.
Actively exploited Not confirmed Patch Tuesday Whether a source of record has confirmed attacks using it in the wild.
Fixed in windows 11 23h2: update to 10.0.22631.7652 or later | windows 11 24h2: update to 10.0.26100.9711 or later | windows 11 25h2: update to 10.0.26200.9711 or later | windows 11 26h1: update to 10.0.28000.3231 or later | windows 11 26h2: update to 10.0.26300.9711 or later | windows server 2025: update to 10.0.26100.33650 or later NVD The version(s) the vendor has published as fixed, where NVD records one.
Public exploit module None known Metasploit Module existing is not the same as active exploitation.
EUVD cross-reference Listed ENISA EUVD ENISA's own vulnerability database entry for this CVE, where one exists.

Impacted software or hardware

  • windows 11 23h2 Operating system — < 10.0.22631.7652
  • windows 11 24h2 Operating system — < 10.0.26100.9711
  • windows 11 25h2 Operating system — < 10.0.26200.9711
  • windows 11 26h1 Operating system — < 10.0.28000.3231
  • windows 11 26h2 Operating system — < 10.0.26300.9711
  • windows server 2025 Operating system — < 10.0.26100.33650

Fixed versions: windows 11 23h2: update to 10.0.22631.7652 or later | windows 11 24h2: update to 10.0.26100.9711 or later | windows 11 25h2: update to 10.0.26200.9711 or later | windows 11 26h1: update to 10.0.28000.3231 or later | windows 11 26h2: update to 10.0.26300.9711 or later | windows server 2025: update to 10.0.26100.33650 or later

Remediation: Apply the vendor patch or guidance: https://github.com/advisories/GHSA-669h-2x66-7gwx | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85803

Remediation basis: External remediation intelligence

ENISA EUVD also lists this CVE at CVSS 7.0 (v3.1), assigned by microsoft. Source: euvd.enisa.europa.eu.

2 days recorded, 2026-10-14 to 2026-10-15

0.25% as of 2026-10-15 (15.5th percentile). FIRST EPSS, recorded daily since this page started tracking it.

2026-10-14 2026-10-15

The primary records

This page is an opinion about urgency. Where it and a source of record disagree, the source of record is the record.

NVD ↗ Microsoft ↗

Where this sits

CVE-2026-85803 is one of the entries ranked on the priority feed and in this month's Microsoft release.