Cyber Posture

CVE-2026-20865

High

Published: 13 January 2026

Published
13 January 2026
Modified
15 January 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0003 9.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-20865 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires timely identification, reporting, and remediation of the use-after-free vulnerability in Windows Management Services via patching per MSRC guidance.

prevent

Implements memory protection mechanisms like ASLR, DEP, and stack canaries that directly counter use-after-free exploits enabling local privilege escalation.

prevent

Limits the scope and impact of low-privileged local attackers by enforcing least privilege, reducing the effectiveness of privilege escalation via the vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Use-after-free in Windows Management Services directly enables local privilege escalation from low-privileged context to full system control.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.

Deeper analysisAI

CVE-2026-20865 is a use-after-free vulnerability (CWE-416) in Windows Management Services that enables local privilege escalation. Published on 2026-01-13, it carries a CVSS v3.1 base score of 7.8 (High), reflecting local attack vector (AV:L), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), changed scope (S:C), and high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H).

An authorized local attacker with low privileges can exploit this vulnerability through a high-complexity attack sequence, potentially achieving full privilege escalation on the affected Windows system. Successful exploitation grants the attacker high-level access, allowing unauthorized control over system resources, data modification, and disruption.

The Microsoft Security Response Center (MSRC) provides detailed guidance on mitigation and patching in its update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20865. Security practitioners should consult this advisory for applicable updates and workarounds.

Details

CWE(s)

Affected Products

microsoft
windows 10 1809
≤ 10.0.17763.8276 · ≤ 10.0.17763.8276
microsoft
windows 10 21h2
≤ 10.0.19044.6809
microsoft
windows 10 22h2
≤ 10.0.19045.6809
microsoft
windows 11 23h2
≤ 10.0.22631.6491
microsoft
windows 11 24h2
≤ 10.0.26100.7623
microsoft
windows 11 25h2
≤ 10.0.26200.7623
microsoft
windows server 2019
≤ 10.0.17763.8276
microsoft
windows server 2022
≤ 10.0.20348.4648
microsoft
windows server 2022 23h2
≤ 10.0.25398.2092
microsoft
windows server 2025
≤ 10.0.26100.32230

CVEs Like This One

CVE-2026-20923Same product: Microsoft Windows 10 1809
CVE-2025-62221Same product: Microsoft Windows 10 1809
CVE-2026-24292Same product: Microsoft Windows 10 1809
CVE-2026-32078Same product: Microsoft Windows 10 1809
CVE-2026-20822Same product: Microsoft Windows 10 1809
CVE-2025-21367Same product: Microsoft Windows 10 1809
CVE-2026-20871Same product: Microsoft Windows 10 21H2
CVE-2026-32155Same product: Microsoft Windows 10 21H2
CVE-2026-33098Same product: Microsoft Windows 10 1809
CVE-2026-20858Same product: Microsoft Windows 10 1809

References