CVE-2026-85916

Published: Oct 13, 2026Modified: Oct 16, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.

Affected (11)

Products: Microsoft: Windows 11 23h2, Windows 11 24h2, Windows 11 25h2, Windows 11 26h1, Windows 11 26h2, Windows Server 2025

6 products

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 11 23h2	version < 10.0.22631.7652
Microsoft Windows 11 23h2	version < 10.0.22631.7652
Microsoft Windows 11 24h2	version < 10.0.26100.9711
Microsoft Windows 11 24h2	version < 10.0.26100.9711
Microsoft Windows 11 25h2	version < 10.0.26200.9711
Microsoft Windows 11 25h2	version < 10.0.26200.9711
Microsoft Windows 11 26h1	version < 10.0.28000.3231
Microsoft Windows 11 26h1	version < 10.0.28000.3231
Microsoft Windows 11 26h2	version < 10.0.26300.9711
Microsoft Windows 11 26h2	version < 10.0.26300.9711
Microsoft Windows Server 2025	version < 10.0.26100.33650

Related CWEs

CWE-359

Exposure of Private Personal Information to an Unauthorized Actor

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85916

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.