CVE-2026-50333

What it actually does

CVE-2026-50333 is a local privilege escalation flaw in the Windows Spaceport.sys driver, which is associated with Windows storage functionality. The driver exposes a critical function without adequate authentication or authorization checks, allowing a locally authenticated low-privileged user to invoke privileged driver behavior that should be restricted. Successful exploitation can allow the attacker to elevate privileges on the affected Windows system, potentially gaining SYSTEM-level control with full confidentiality, integrity, and availability impact.

Why it matters to the business

An attacker who already has a foothold on an affected Windows workstation or server could turn a limited account into full system control. This can enable credential theft, security tool tampering, lateral movement, data access, service disruption, or deployment of malware. Because the affected products include widely deployed Windows client and server versions, organizations should treat this as an important post-compromise escalation risk even though it is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and currently has low EPSS probability.

How an attack unfolds

Exploitation requires local access with a valid user context; this is not a remote unauthenticated entry point. An attacker first gains access to an affected Windows system through phishing, stolen credentials, malware, RDP/VPN misuse, or another vulnerability. From that low-privileged context, the attacker runs code that interacts with the vulnerable Spaceport.sys driver and invokes a sensitive driver function that lacks proper authentication. If the call succeeds, the attacker escalates from a standard user context to a highly privileged local context, commonly SYSTEM or equivalent kernel-adjacent control. With elevated privileges, the attacker can disable defenses, dump credentials, install persistence, access protected files, create administrative users, or move laterally to other systems.

How to fix it

Apply the applicable Microsoft security update for each affected Windows version: Windows 10 1607, 1809, 21H2, 22H2; Windows 11 24H2, 25H2, 26H1; Windows Server 2016, 2019, 2022, and 2025. Because no explicit fixed build or KB list was provided, use the latest cumulative security update available from Microsoft for the affected release and verify against Microsoft’s official CVE guidance. Prioritize systems where local compromise would be high impact, including servers, administrator workstations, shared workstations, jump hosts, virtualization hosts, storage-related servers, and systems with broad domain or cloud administrative access. If immediate patching is not possible, reduce risk by enforcing least privilege, limiting interactive logon rights, restricting RDP and remote management access, preventing untrusted code execution, enabling EDR/AV tamper protection, and monitoring for local privilege escalation behavior. Do not rely on driver removal or manual modification unless Microsoft explicitly documents it as supported, because Spaceport.sys may be part of normal Windows storage functionality.

How to confirm the fix worked

Confirm exposure by inventorying Windows systems and identifying those running affected client or server releases. Validate remediation by confirming the relevant Microsoft cumulative security update has been installed through Windows Update, WSUS, Configuration Manager, Intune, vulnerability management tooling, or local update inventory such as installed hotfix/package checks. Where available, compare the Spaceport.sys file version and signature against Microsoft’s patched baseline for the specific OS build. Reboot systems where required and verify that the updated driver is loaded. Run authenticated vulnerability scans after patching to confirm the CVE is no longer reported. For compensating controls, validate that non-administrative users cannot install or execute untrusted local binaries, that endpoint protection is active, and that local privilege escalation detections are enabled.

Typical attack path

1. Gain initial local code execution or an interactive/logon session on an affected Windows host.
2. Confirm the system is running an affected Windows version and that the vulnerable Spaceport.sys driver is present.
3. Execute a local privilege escalation tool or custom code that sends crafted requests to the vulnerable Spaceport.sys functionality.
4. Abuse the missing authentication check to perform a privileged driver operation from a low-privileged context.
5. Obtain elevated local privileges, typically SYSTEM-level execution.
6. Use elevated privileges to disable defenses, dump credentials, establish persistence, access sensitive data, or pivot to additional systems.

How to detect it

There are no public, CVE-specific exploit indicators provided for this vulnerability, and exploit maturity is currently listed as none. Detection should focus on behavioral evidence of local privilege escalation and post-exploitation. Review Windows Security logs for unusual privilege use, process creation, account creation, group membership changes, service installation, and log clearing. Useful events include 4624 for suspicious local or remote logons, 4672 for special privileges assigned to a new logon, 4688 for suspicious process creation, 4720 for new local user creation, 4732/4738 for privileged group or account changes, 4697 or System 7045 for service installation, and 1102 for audit log clearing. Review Sysmon or EDR telemetry for a low-privileged process opening or interacting with the Spaceport.sys driver, followed shortly by SYSTEM-level process execution, credential access tools, AV/EDR tampering, or lateral movement tools. Correlate suspicious activity with the presence of the vulnerable OS build and lack of the relevant Microsoft security update. Also examine Defender/EDR alerts for privilege escalation, token manipulation, suspicious driver access, credential dumping, LSASS access, local administrator creation, and persistence mechanisms created shortly after a standard user process executed from a user-writable directory.

What your security team should do

• Patch affected Windows client and server systems with the latest applicable Microsoft cumulative security update, prioritizing servers, privileged access workstations, shared systems, and internet-adjacent systems that could be used for follow-on escalation.
• Use vulnerability management or endpoint inventory to identify all affected Windows 10, Windows 11, and Windows Server versions and track remediation to completion.
• Hunt for signs of local privilege escalation followed by post-exploitation activity, especially low-privileged processes spawning SYSTEM shells, new local administrators, credential dumping, or security tool tampering.
• Ensure EDR, Microsoft Defender, and Windows security logging are enabled and centrally collected for process creation, privilege assignment, service installation, account creation, and driver-related activity.
• Restrict local administrator rights and interactive logon permissions to reduce the number of accounts that can turn an initial foothold into full host control.
• Block or alert on suspicious execution from user-writable paths, scripting engines, and unsigned binaries that attempt to interact with kernel drivers or spawn elevated child processes.
• Because the CVE is not currently in KEV and EPSS is low, schedule broad fleet remediation through the normal high-severity patch process, but accelerate patching for high-value systems and systems with prior compromise indicators.