CVE-2026-85884: WPAD LPAC and WHESVC Privilege Escalation

Summary

A Windows privilege-boundary vulnerability affects the Windows Health and Optimized Experiences service (whesvc) and the Windows Diagnostics Lua engine. An attacker running low-privileged or WPAD LPAC code can trigger a trusted ETW workflow event to load and execute an arbitrary Lua module. Successful exploitation enables local privilege escalation to the SYSTEM account.

Investigation

Research shows that the LocalSystem service processes ETW events without sufficiently validating the event producer or restricting the locations from which Lua modules can be loaded. The proof-of-concept uses a PowerShell script to trigger the workflow and launches whoami.exe through cmd.exe, confirming successful execution with SYSTEM-level privileges.

Mitigation

Users should consult the Microsoft Security Response Center (MSRC) update guide for CVE-2026-85884 and apply the relevant security patches. Enforcing the principle of least privilege and monitoring unusual ETW event activity associated with whesvc can provide additional defensive coverage.

Response

When unauthorized LocalSystem service activity or suspicious PowerShell execution involving the whesvc workflow is detected, organizations should isolate the affected host. Review ETW telemetry for anomalous Microsoft.Windows.Diagnostics.Lua events and inspect Lua modules for unauthorized or unexpected modifications.

Simulation Execution

• Attack Narrative & Commands: The adversary has gained initial access to a workstation and identified a vulnerability in the whesvc service. To escalate privileges to SYSTEM, the attacker downloads a script named Invoke-WhesvcToSystem.ps1. They execute this script using powershell.exe with the -ExecutionPolicy Bypass flag to circumvent local security restrictions. Once the exploit runs, the attacker immediately executes whoami /user to confirm they have successfully transitioned from a standard user context to the NT AUTHORITYSYSTEM context. This sequence is designed to match the specific detection signatures provided in the rule.

• Regression Test Script:

  # 1. Create a dummy version of the exploit script to satisfy the command line check
  $scriptPath = "$env:TEMPInvoke-WhesvcToSystem.ps1"
  "Write-Output 'Simulating Exploit...'" | Out-File -FilePath $scriptPath -Encoding utf8
  
  # 2. Execute the command exactly as defined in the detection logic
  # This should trigger the rule
  Start-Process "powershell.exe" -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File .$scriptPath" -Wait
  
  # 3. Execute the secondary detection trigger (whoami /user)
  cmd.exe /c "whoami /user"

• Cleanup Commands:

  # Remove the simulated exploit script
  Remove-Item -Path "$env:TEMPInvoke-WhesvcToSystem.ps1" -Force