Microsoft Releases Out-of‑Band Windows 11 Update to Patch Critical Audio Glitch and Remote Code Execution Vulnerabilities (CVE‑2026‑62721, CVE‑2026‑85921)
What Happened — Microsoft issued an out‑of‑band update for Windows 11 24H2, 25H2 and 26H2 that resolves a legacy USB‑audio driver glitch and patches three security flaws, including CVE‑2026‑62721 (remote code execution) and CVE‑2026‑85921 (local privilege escalation).
Why It Matters for Trust & Control Assurance —
- The episode underscores the importance of a continuous vulnerability‑management and patch‑deployment program that can surface, assess, and remediate flaws before they are weaponised.
- Timely patching supplies audit‑ready evidence that the “vulnerability management” control objective is operating effectively across multiple frameworks.
- Verisq’s Control‑Mapping capability helps map these patches to the underlying control objective and collect defensible evidence for auditors.
Who Is Affected — Enterprises and end‑users in all verticals that run Windows 11, especially those with legacy USB Audio Class 1.0 devices or on‑prem Hyper‑V hosts.
Recommended Actions —
- Deploy the out‑of‑band update to every Windows 11 endpoint without delay.
- Add CVE‑2026‑62721 and CVE‑2026‑85921 to your vulnerability inventory and risk register.
- Capture patch‑deployment logs and remediation tickets as evidence for control‑assurance audits. Source: ZDNet article
Technical Notes — The audio issue originated from the legacy USB Audio Class 1.0 driver introduced in Windows 98. CVE‑2026‑62721 could allow a remote attacker to gain system‑level privileges; CVE‑2026‑85921 enables local privilege escalation to access protected files. Additional bugs affect Remote Desktop Services stability and Hyper‑V VM folder sharing. Source: ZDNet