CVE-2026-85359CWE-94code-injection
CVE-2026-85359
High · published October 13, 2026
What it is
Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
The record
Technical detail
- CVSS v3.1
- 7.8 · HIGH
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00745 · 54.3th percentile
- Weakness
- CWE-94 · Improper Control of Generation of Code ('Code Injection')
- Published
- 2026-10-13T23:20Z
References (1)
EPSS history
Timeline