CVE-2026-85333 is a medium severity race condition in Windows Performance Monitor. An authorized local user could use it to raise their privileges. It affects several Windows 10 and Windows 11 builds, and Microsoft's update guide lists the fix for each, so install the update for your build.
What's affected
- Product: Windows Performance Monitor, on Windows 10 versions 1607, 1809, 21H2 and 22H2, and Windows 11 versions 23H2, 24H2, 25H2 and 26H1, per the record.
- Fixed versions: the Microsoft Security Response Center page is the source. It needs JavaScript, so I could not read it for this review. Open the entry for CVE-2026-85333 and match the update to your build.
- Attack needs: local access, an authorized account, and user interaction.
Severity in the record: Medium, CVSS 6.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
Weakness class: CWE-362 (Race Condition).
How to check if you're exposed
- Find your Windows version and build with
winver, or in PowerShell with[System.Environment]::OSVersion.Version. - Compare it with the product list in the record: Windows 10 versions 1607, 1809, 21H2 and 22H2, and Windows 11 versions 23H2, 24H2, 25H2 and 26H1.
- List installed updates with
Get-HotFixin PowerShell, and compare against the update named on the MSRC page for your build. - In a managed fleet, use your update management console to report which devices are missing the update.
What to do now
- Open the Microsoft Security Update Guide entry for CVE-2026-85333 and note the update for each Windows build you run.
- Deploy that update through your normal patch channel, starting with shared and multi user machines.
- Reboot where the update requires it, and verify with
Get-HotFix. - Remove local administrator rights from users who do not need them, since escalation flaws matter most where users hold footholds.
- Keep a short list of Windows 10 builds that may be out of general support, and plan their replacement.
Why it matters
A race condition happens when two operations use the same resource and the outcome depends on timing. The weakness here is concurrent execution with improper synchronization, CWE-362. The record is brief and gives no more detail, which is common for Microsoft entries.
The rating is Medium because the attack is local, needs a low privilege account and user interaction, and has high attack complexity. Even so, local privilege escalation is a common second step after an initial foothold, so it is worth patching on schedule. The record does not mark this CVE as exploited in the wild, and it is not on the CISA list.
Quick check
Can this be exploited over the network?
The record describes a local attack, so an attacker needs to be on the machine already. Network exposure alone does not make you vulnerable.
Sources
Last reviewed: 18 October 2026.
