CVE-2026-85862: Microsoft Windows Error Reporting Race Condition Vulnerability

Affected Products

• Microsoft Windows Error Reporting: see the vendor advisory for the exact affected versions

Discovery Timeline

• 2026-11-10: CVE-2026-85862 published to the National Vulnerability Database by secure@microsoft.com
• 2026-11-10: last updated in the NVD database

Vulnerability Analysis

Root Cause

Attack Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Detection Strategies

• Inventory every instance of Microsoft Windows Error Reporting and compare the running version with the affected range above.
• Check external attack surface scans for internet facing instances of the component.
• Run an authenticated vulnerability scan once your scanner ships a check for this CVE.

Monitoring Recommendations

• Forward Microsoft Windows Error Reporting application, access and audit logs to your SIEM for retrospective hunting.
• Alert on new processes, configuration changes or outbound connections from the affected service.
• Track the vendor advisory and the CISA KEV catalog for changes in exploitation status.

Immediate Actions Required

• Apply the fixed version of Microsoft Windows Error Reporting named in the vendor advisory.
• Prioritize internet facing and business critical instances first.
• Rescan after the change to confirm the exposure is closed.

Patch Information

• Microsoft Security Response Center advisory

Workarounds

• If patching must wait, restrict network access to the affected service and place it behind authentication or a web application firewall rule.