Microsoft Windows Subsystem For Linux WSL2 vulnerabilities

2 CVEs affecting Microsoft Windows Subsystem For Linux WSL2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-96206, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-96206, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.
• CVE-2026-85879, published 2026-10-13. High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days. Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.