A Windows service that grants privilege without asking who is calling
CVE-2026-85884 is a missing authentication check in the Windows Health and Optimized Experiences Service that lets a local attacker turn ordinary user code into administrative privilege.




