{"id":"CVE-2026-85907","kind":"vulnerability","aliases":["CVE-2026-85907"],"related":[],"title":"Windows SSDP Service: improper authentication lets a local user gain privileges","description":"Improper authentication in Windows SSDP Service allows an authorized attacker to elevate privileges locally.","summary":"The Windows SSDP Service has an improper authentication flaw. An attacker who already has a local account can raise their privileges on the machine.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","self-hosted","windows"],"not_affected_if":["no-local-users","ssdp-disabled"],"how_to_check":"- Check the Windows build and patch level with `winver` or Settings > System > About, then compare against Microsoft's advisory for CVE-2026-85907.\n- Check whether the SSDP Discovery service (SSDPSRV) is running with `sc query SSDPSRV`.","fix":null,"status":"open","published_at":"2026-11-10T19:21:26+00:00","first_seen_at":"2026-11-10T19:25:18+00:00","triaged_at":"2026-11-10T20:04:26+00:00","updated_at":"2026-11-10T20:04:26+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T20:04:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows SSDP Service: improper authentication lets a local user gain privileges","impact":"high","summary":"The Windows SSDP Service has an improper authentication flaw. An attacker who already has a local account can raise their privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher privileges on the Windows machine","analyst_note":"Pull Microsoft's advisory for CVE-2026-85907 to get affected builds, the fixed update, and whether SSDPSRV must be running.","how_to_check":"- Check the Windows build and patch level with `winver` or Settings > System > About, then compare against Microsoft's advisory for CVE-2026-85907.\n- Check whether the SSDP Discovery service (SSDPSRV) is running with `sc query SSDPSRV`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users","ssdp-disabled"],"who_is_affected":"Windows machines where a local user already has an account. The sources do not name affected builds or the exact authentication path, so treat any unpatched Windows host as in scope until Microsoft's advisory is checked. Systems where the SSDP service is stopped or disabled are likely lower exposure, but the sources do not confirm this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000719,"input_tokens":4485,"output_tokens":540,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-85907':14A,17A 'account':39B 'allow':53C 'alreadi':35B 'attack':33B,56C 'authent':5A,30B,48C 'author':55C 'cve':12A,15A 'elev':58C 'flaw':31B 'gain':10A 'host':21B 'improp':4A,29B,47C 'infrastructur':18B 'let':6A 'local':8A,38B,60C 'machin':46B 'privileg':11A,43B,59C 'rais':41B 'self':20B 'self-host':19B 'servic':3A,26B,52C 'ssdp':2A,25B,51C 'user':9A 'window':1A,22B,24B,50C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where a local user already has an account. The sources do not name affected builds or the exact authentication path, so treat any unpatched Windows host as in scope until Microsoft's advisory is checked. Systems where the SSDP service is stopped or disabled are likely lower exposure, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","medium","selfhosted","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-85907':14A,17A 'authent':5A 'cve':12A,15A 'gain':10A 'improp':4A 'let':6A 'local':8A 'privileg':11A 'servic':3A 'ssdp':2A 'user':9A 'window':1A","search_b":"'account':39B 'alreadi':35B 'attack':33B 'authent':30B 'flaw':31B 'host':21B 'improp':29B 'infrastructur':18B 'local':38B 'machin':46B 'privileg':43B 'rais':41B 'self':20B 'self-host':19B 'servic':26B 'ssdp':25B 'window':22B,24B","search_c":"'allow':53C 'attack':56C 'authent':48C 'author':55C 'elev':58C 'improp':47C 'local':60C 'privileg':59C 'servic':52C 'ssdp':51C 'window':50C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85907","severity":null,"published_at":"2026-11-10T19:21:26+00:00","modified_at":"2026-11-10T19:21:26+00:00","first_seen_at":"2026-11-10T19:25:18+00:00","fetched_at":"2026-11-10T19:25:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}