CVE-2026-85843

7.8High

Published 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

7.8High

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-908

Impact

A local attacker with standard user access can elevate privileges to SYSTEM. They need prior code execution or local credentials on the target Windows machine.

Root cause

Windows Background Intelligent Transfer Service (BITS) uses an uninitialized resource during operation.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Install the relevant Microsoft security update from the vendor advisory for your Windows version; alternatively, disable the Background Intelligent Transfer Service (BITS) service if patching cannot be done immediately.

shell

$ Get-Service BITS | Stop-Service -PassThru | Set-Service -StartupType Disabled

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85843

Source: nvd.nist.gov/vuln/detail/CVE-2026-85843