CVE-2026-50360

What it actually does

CVE-2026-50360 is a network-reachable privilege escalation vulnerability in Windows SMB Server caused by an incorrect implementation of an authentication algorithm. An attacker who already has valid low-privileged credentials can interact with the SMB service over the network and cause the server to incorrectly evaluate authentication or authorization state, resulting in elevated privileges. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity, and availability impact, successful exploitation may allow the attacker to access protected SMB resources, modify data, or perform privileged actions without user interaction.

Why it matters to the business

Organizations running affected Windows client or server versions may face elevated risk from compromised domain or local accounts, because a low-privileged attacker with network access could turn ordinary SMB access into broader control over sensitive files, systems, or services. This is especially important for file servers, domain-joined systems, administrative shares, and environments where SMB is widely reachable. Although the issue is not currently listed in CISA KEV and public exploit maturity is reported as none, the low attack complexity and high impact make timely patching important, particularly because SMB is commonly exposed inside enterprise networks and frequently targeted during lateral movement.

How an attack unfolds

An attacker first obtains valid credentials for an affected Windows system or domain account through phishing, password reuse, malware, credential theft, or prior compromise. The attacker then connects to the target system’s SMB service over TCP port 445 and performs authentication using crafted SMB session setup or related authentication messages that take advantage of the flawed authentication algorithm implementation. If the server incorrectly validates the authentication state, the attacker’s session may receive privileges beyond those normally assigned to the account. With elevated access, the attacker can enumerate or access protected shares, read or alter sensitive files, interact with administrative shares where permitted by the elevated context, stage tools for lateral movement, or disrupt services and data availability. There is no indication from the provided intelligence that exploitation is currently public or used in ransomware campaigns, but the vulnerability’s characteristics make it valuable after initial credential compromise.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-50360 for all affected Windows versions, including Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025. No fixed build numbers were provided in the input, so administrators should use the applicable Microsoft Security Update Guide entry, Windows Update, WSUS, Microsoft Configuration Manager, or equivalent patch management tooling to deploy the relevant cumulative update. Where immediate patching is not possible, reduce exposure by restricting SMB access to trusted networks, blocking inbound TCP 445 from untrusted segments, disabling SMB where not required, enforcing least privilege on SMB shares, removing unnecessary local administrator rights, and monitoring or limiting use of administrative shares. Ensure SMB signing and modern authentication protections are enabled according to Microsoft hardening guidance, but do not treat these controls as substitutes for patching unless Microsoft explicitly identifies them as complete mitigations.

How to confirm the fix worked

Confirm that each affected Windows endpoint and server has installed the Microsoft cumulative/security update that includes the fix for CVE-2026-50360. Validate through Windows Update history, WSUS or endpoint management compliance reports, PowerShell inventory of installed hotfixes or build numbers, and vulnerability scanner plugins once available. Confirm that SMB exposure is limited by testing whether TCP 445 is reachable only from approved management and internal network segments. Review SMB server configuration and share permissions to ensure least privilege is enforced. After patching, perform authenticated vulnerability scans or configuration compliance checks to verify the system no longer reports as vulnerable. For high-value file servers and domain-joined servers, additionally validate that no unexpected SMB administrative access or anomalous share permission changes occurred before remediation.

Typical attack path

1. Acquire valid low-privileged credentials for a Windows local or domain account.
2. Identify reachable affected Windows systems exposing SMB, typically over TCP port 445.
3. Initiate SMB authentication to the target using crafted authentication/session messages.
4. Trigger the authentication algorithm flaw so the SMB server grants higher privileges than intended.
5. Use the elevated SMB access to read, write, or delete protected files, access restricted shares, or interact with administrative paths.
6. Leverage the gained access for lateral movement, data theft, persistence staging, or operational disruption.

How to detect it

To determine whether exploitation may already have occurred, review Windows Security, SMB Server, PowerShell, Sysmon, and endpoint detection logs for unusual SMB authentication and file access patterns involving low-privileged accounts. Focus on Event ID 4624 logons with LogonType 3 from unusual source hosts, especially followed by access to sensitive shares, administrative shares, or files the account normally cannot access. Correlate authentication events with object access auditing events such as 5140 and 5145 for share access, 4663 for file access where enabled, and account or privilege-change events such as 4672, 4732, 4738, and 4756. Look for anomalous SMB sessions from workstations to many servers, failed-then-successful authentication bursts, access to C$, ADMIN$, IPC$, or high-value file shares, unexpected file creation or modification on shares, and remote tool staging over SMB. Endpoint telemetry should be reviewed for service creation, scheduled task creation, or process execution following SMB file writes, such as PsExec-like behavior. Because no public exploit details or named threat actors are provided, detection should emphasize behavioral anomalies around SMB authentication, privilege elevation, and post-exploitation activity rather than relying on exploit-specific signatures.

• TCP/445
• LogonType=3
• Event ID 4624
• Event ID 4625
• Event ID 4672
• Event ID 4663
• Event ID 5140
• Event ID 5145
• Event ID 4732
• Event ID 4738
• Event ID 4756
• \\*\C$
• \\*\ADMIN$
• \\*\IPC$
• \\*\SYSVOL
• \\*\NETLOGON
• \Windows\Temp\psexesvc.exe
• PSEXESVC
• ADMIN$
• C$
• IPC$

What your security team should do

• Prioritize patching Windows servers and high-value workstations that expose SMB, especially file servers, domain-joined infrastructure, and systems reachable by broad internal user populations.
• Inventory all affected Windows versions and track remediation through centralized patch management until coverage is complete.
• Restrict inbound SMB over TCP 445 to required hosts and network segments; block SMB from untrusted networks and unnecessary east-west paths.
• Hunt for suspicious SMB authentication and access activity from low-privileged accounts, especially successful access to administrative or sensitive shares inconsistent with baseline behavior.
• Review share permissions, local administrator group membership, and delegated privileges to reduce the blast radius of compromised credentials.
• Enable or strengthen logging for SMB server access, Windows authentication events, object access auditing on sensitive shares, and endpoint telemetry around remote file writes and service creation.
• Monitor Microsoft guidance for fixed build details, exploitability updates, and any change in exploitation status, because public exploit availability would substantially increase urgency.