CVE-2026-49800

What it actually does

CVE-2026-49800 is a local privilege escalation vulnerability in the Windows Web Proxy Auto-Discovery Protocol implementation. An integer overflow or wraparound condition can cause incorrect size or bounds calculations inside WPAD-related processing, allowing a low-privileged, authenticated local attacker to influence memory handling and potentially execute code with elevated privileges. The CVSS vector indicates local access, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impact, consistent with a vulnerability that can be used to gain administrative or SYSTEM-level control after initial access.

Why it matters to the business

Successful exploitation can turn a low-privileged foothold on a Windows workstation or server into full local control, enabling credential theft, security tool tampering, lateral movement, data access, and deployment of additional malware. This is especially relevant because the affected products include widely deployed Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 versions. The vulnerability is not currently listed in CISA KEV, has no reported ransomware use, and has no known public exploit maturity in the provided data, but privilege escalation flaws are commonly chained with phishing, drive-by compromise, stolen credentials, or remote code execution vulnerabilities to complete an attack.

How an attack unfolds

An attacker first obtains local authenticated access to an affected Windows system, such as through stolen credentials, malware execution under a standard user account, exploitation of another vulnerability, or interactive access. The attacker then triggers vulnerable WPAD-related processing in a way that causes an integer overflow or wraparound during proxy auto-discovery handling. By shaping the data or execution conditions that reach the vulnerable code path, the attacker attempts to corrupt or misdirect memory operations and run attacker-controlled code in a more privileged security context. If successful, the attacker escalates from a low-privileged user to an elevated local context, after which they may dump credentials, disable defenses, install persistence, move laterally, or deploy additional tooling. No named threat actors or active exploitation campaigns are identified in the provided data.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-49800 for all affected Windows versions, including Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 24H2, Windows 11 25H2, Windows 11 26H1, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No exact fixed build numbers were provided in the input, so remediation should be validated against Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or the organization’s patch management source of truth. Prioritize systems where untrusted users can log on interactively, shared workstations, VDI, jump hosts, developer workstations, and servers exposed to many administrators or service accounts. As defense-in-depth, disable WPAD where it is not required, avoid unauthenticated or untrusted proxy auto-discovery behavior, harden local user rights, restrict interactive logon, and ensure endpoint protection and credential protections are enabled.

How to confirm the fix worked

Confirm that each affected Windows host has installed the Microsoft cumulative or security update containing the fix. Validate using Windows Update history, installed hotfix inventory, endpoint management compliance reports, vulnerability scanner plugin results, or Microsoft Security Update Guide applicability checks. For manual validation, compare OS version, edition, and build against Microsoft’s fixed build information once available. Also verify that unsupported or out-of-maintenance Windows versions are not present. Where WPAD is not needed, confirm it is disabled or constrained by policy and that proxy configuration still functions as intended after mitigation. Vulnerability scanners should be rerun after patch deployment to confirm the CVE no longer appears on affected assets.

Typical attack path

1. Gain authenticated local access to an affected Windows workstation or server with low privileges.
2. Identify that the host runs a vulnerable Windows version with WPAD components present and unpatched.
3. Trigger the vulnerable WPAD code path using crafted local inputs or conditions related to proxy auto-discovery handling.
4. Exploit the integer overflow or wraparound to manipulate memory handling and execute code in an elevated local context.
5. Use the elevated privileges to access sensitive data, dump credentials, disable security controls, establish persistence, or move laterally.

How to detect it

There are no exploit-specific public indicators provided, so detection should focus on suspicious activity around local privilege escalation and WPAD-related processes. Review Windows Security logs for new local administrator membership, privilege assignment changes, service creation, scheduled task creation, and suspicious logon activity following execution by a low-privileged account. Relevant events include 4624, 4627, 4672, 4688, 4697, 4698, 4720, 4728, 4732, 7045, and PowerShell operational events if script-based follow-on activity occurred. Review System and Application logs for crashes or abnormal restarts involving svchost.exe instances hosting WPAD or WinHTTP AutoProxy functionality, especially shortly before privilege changes. Endpoint telemetry should be searched for unusual child processes spawned by svchost.exe, attempts to access LSASS, security tool termination, local administrator group modification, creation of new services, credential dumping tools, and persistence artifacts. Network telemetry may show WPAD or proxy auto-discovery lookups, but these are common in normal environments and should only be treated as supporting context, not standalone proof of compromise. If exploitation is suspected, collect memory, event logs, endpoint process lineage, scheduled tasks, services, local users/groups, recent binaries in user-writable paths, and proxy/WPAD configuration for forensic review.

• WinHttpAutoProxySvc
• WPAD
• wpad.dat
• svchost.exe -k LocalServiceNetworkRestricted
• Microsoft-Windows-WinHttp
• Microsoft-Windows-WinINet
• Event ID 4688
• Event ID 4672
• Event ID 4728
• Event ID 4732
• Event ID 4697
• Event ID 7045
• Faulting application name: svchost.exe
• net localgroup administrators
• Add-LocalGroupMember
• Microsoft\Windows\Wpad

What your security team should do

• Inventory all Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems and identify those missing the relevant Microsoft security update.
• Prioritize patching shared endpoints, servers with multiple administrators, VDI platforms, remote access hosts, jump servers, and systems used by privileged personnel.
• Review whether WPAD is required; disable or restrict it where business operations do not depend on proxy auto-discovery.
• Monitor for suspicious local privilege escalation behavior, including unusual child processes from Windows service hosts, unexpected administrative group changes, credential dumping activity, and endpoint security tampering.
• Harden local privilege boundaries by limiting interactive logon rights, removing unnecessary local administrator access, enforcing application control where feasible, and enabling credential protections such as LSASS protection and Credential Guard where supported.
• Because the vulnerability is 28 days past publication and has a moderate CVSS score with low current EPSS, treat it as important patching rather than confirmed emergency exploitation unless local threat intelligence indicates active abuse.
• Create detection content focused on post-exploitation outcomes because public, exploit-specific indicators are not available from the provided information.