CVE-2026-50335

What it actually does

This vulnerability is a local privilege escalation flaw caused by improper access control in Microsoft Windows. An attacker who already has valid low-privileged local access can abuse the access-control weakness to execute actions with elevated privileges, potentially gaining administrative or SYSTEM-level control. Successful exploitation can compromise confidentiality, integrity, and availability on the affected host because the attacker may be able to read protected data, modify system configuration, disable security controls, install persistence, or execute privileged code. The CVSS vector indicates local access is required, exploitation complexity is low, no user interaction is required, and the impact is high across confidentiality, integrity, and availability.

Why it matters to the business

The primary business risk is that an attacker who has already gained an initial foothold on a Windows workstation or server could turn limited access into full control of that system. On servers, this can enable deeper compromise of business applications, identity infrastructure, file shares, backup systems, or administrative tooling. On workstations, it can allow credential theft, endpoint security tampering, lateral movement, and persistence. Although this vulnerability is not currently listed in CISA KEV, has no known public exploit maturity in the provided data, and has a low EPSS score, the affected product set is broad across Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025, so exposure may be widespread in enterprise environments.

How an attack unfolds

An attacker must first obtain local access to an affected Windows system, typically through phishing, stolen credentials, remote access misuse, malware execution, or exploitation of a separate vulnerability that provides a low-privileged shell or user session. Once present on the host, the attacker abuses the improper access control condition to perform privileged operations that should be restricted. If successful, the attacker escalates from a standard user context to a higher-privileged context, potentially administrator or SYSTEM. With elevated privileges, the attacker can dump credentials, modify security settings, disable endpoint protections, install services or scheduled tasks for persistence, access sensitive files, and use the host as a staging point for lateral movement. There is no indication from the provided data that this vulnerability is currently exploited in the wild or used in ransomware campaigns.

How to fix it

Apply the Microsoft security update that remediates this vulnerability for all affected Windows versions as soon as it is available through Windows Update, Microsoft Update Catalog, Windows Server Update Services, Microsoft Configuration Manager, or another enterprise patch management platform. Prioritize internet-adjacent Windows systems, servers used for administration, domain-joined endpoints, shared workstations, virtual desktop infrastructure, and systems accessed by privileged users. Because no exact fixed build numbers were provided, verify remediation against Microsoft’s official advisory and update history for each affected product: Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 24H2, Windows 11 25H2, Windows 11 26H1, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Where immediate patching is not possible, reduce risk by limiting interactive logon rights, removing unnecessary local administrator access, enforcing least privilege, hardening endpoint protection, enabling tamper protection, restricting execution from user-writable locations, and monitoring for suspicious privilege escalation behavior. Treat mitigations as temporary; patching is the primary remediation.

How to confirm the fix worked

Confirm that affected Windows systems have received the Microsoft security update that includes the fix for this vulnerability. Validate through centralized patch management reporting, Windows Update history, installed cumulative update checks, and operating system build verification against Microsoft’s official fixed build information. For servers and high-risk endpoints, perform spot checks using PowerShell, Windows Update APIs, vulnerability management scans, or authenticated configuration assessments. Confirm that no affected Windows versions remain unpatched, including offline, rarely rebooted, virtual desktop, golden image, lab, and disaster recovery systems. After deployment, verify that systems have rebooted where required and that endpoint security, logging, and policy enforcement remain operational.

Typical attack path

1. Gain initial access to an affected Windows workstation or server using separate means such as stolen credentials, phishing, malware, or another vulnerability.
2. Establish a low-privileged local user session or code execution context on the host.
3. Identify that the Windows version is affected and missing the relevant security update.
4. Trigger the improper access control condition to perform an operation normally restricted to privileged users.
5. Escalate privileges to a higher-integrity or administrative context, potentially SYSTEM.
6. Disable or evade security tools, collect credentials or sensitive files, and establish persistence.
7. Use the elevated access to move laterally, compromise additional systems, or support broader intrusion objectives.

How to detect it

Because the provided vulnerability details do not include a specific exploit primitive, there are no reliable vulnerability-specific indicators of compromise. Detection should focus on evidence that a low-privileged account obtained elevated control after initial access. Review Windows Security logs, Sysmon logs, EDR telemetry, PowerShell logs, service control events, scheduled task events, local account management events, and endpoint protection events around suspicious logons or malware activity. Key areas to investigate include unexpected privilege changes, new local administrators, suspicious service creation, scheduled task creation, process launches from user-writable directories, credential dumping attempts, endpoint security tampering, and abnormal parent-child process relationships leading to elevated shells or system utilities. Useful Windows event sources include Security.evtx, System.evtx, Microsoft-Windows-Sysmon/Operational, Microsoft-Windows-PowerShell/Operational, Microsoft-Windows-TaskScheduler/Operational, and EDR process/network telemetry. Correlate low-privileged logon events followed shortly by administrative actions, service installation, token manipulation alerts, credential access detections, or lateral movement activity. If threat hunting identifies possible exploitation, preserve forensic artifacts including event logs, prefetch files, Amcache, Shimcache, SRUM, scheduled task definitions, service registry keys, EDR timelines, and memory captures where appropriate.

What your security team should do

• Inventory all affected Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems and identify unpatched assets.
• Prioritize patching for servers, administrator workstations, domain-joined endpoints, systems with privileged-user activity, and hosts with prior suspicious activity.
• Deploy the relevant Microsoft cumulative security updates and confirm successful reboot and build compliance.
• Review local administrator group membership, privileged access assignments, and interactive logon permissions to reduce the number of accounts that can benefit from local privilege escalation.
• Hunt for signs of post-compromise privilege escalation, including unexpected service creation, scheduled tasks, security tool tampering, credential dumping behavior, and new privileged accounts.
• Ensure endpoint detection and response tooling is active, tamper protection is enabled, and alerts are generated for privilege escalation and credential access techniques.
• Update golden images, virtual desktop templates, server templates, and offline images so newly provisioned systems are not reintroduced in a vulnerable state.
• Track Microsoft advisory updates because exploit maturity, fixed build details, or mitigation guidance may change after publication.