CVE-2026-50391

What it actually does

This is a local privilege-escalation vulnerability in Windows Group Policy caused by improper privilege management. A low-privileged, authenticated user on an affected Windows client or server can abuse Group Policy handling or policy-related permissions to execute actions with higher privileges, potentially reaching local administrator or SYSTEM-level control. Successful exploitation can provide full local confidentiality, integrity, and availability impact on the compromised host.

Why it matters to the business

An attacker who already has a standard user foothold on an affected Windows workstation or server could turn that access into full control of the machine. This can enable credential theft, disabling of security tools, lateral movement, persistence, data tampering, and deployment of additional malware. The issue affects many supported Windows desktop and server versions, so organizations with broad Windows estates should treat it as a high-priority endpoint and server patching item even though it is not currently listed in CISA KEV and no public exploit maturity is indicated.

How an attack unfolds

An attacker first obtains valid low-privileged local access to an affected Windows system, such as through phishing, stolen credentials, malware execution, or abuse of another vulnerability. They then interact with vulnerable Group Policy behavior where Windows does not correctly enforce the intended privilege boundary. By manipulating policy processing, policy-related state, or policy-controlled execution paths, the attacker causes Windows to apply or execute something under a more privileged security context than the user should control. Once the policy refresh, logon, reboot, or related Group Policy processing event occurs, the attacker gains elevated local privileges. With elevated privileges, they can create or modify administrator accounts, extract credentials, disable defenses, install persistence, or use the host as a launch point for broader compromise.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No exact fixed build numbers were provided in the input, so validate against the Microsoft Security Update Guide or the applicable monthly cumulative update for the affected product line. Prioritize servers, administrator workstations, shared workstations, domain-joined endpoints, jump hosts, and systems where standard users can log on interactively. Until patching is complete, reduce exposure by limiting local interactive logon rights, removing unnecessary local administrator memberships, enforcing least privilege, monitoring Group Policy changes and refresh activity, and using endpoint controls to prevent untrusted local code execution.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows system has installed the vendor security update or a later cumulative update that supersedes it. Use enterprise patch management, vulnerability scanning, or host queries such as Windows Update inventory, Get-HotFix, systeminfo, or device management compliance reports to confirm update status. Validate that affected Windows 10, Windows 11, and Windows Server versions are no longer reported as vulnerable by authenticated scans. Where possible, test a representative patched system to ensure Group Policy continues to process normally and that standard users cannot modify policy-controlled execution paths, policy state, local security settings, or privileged Group Policy artifacts.

Typical attack path

1. Gain authenticated low-privileged access to an affected Windows workstation or server.
2. Identify that the host is running a vulnerable Windows version and has not received the relevant security update.
3. Abuse the Group Policy privilege-management flaw to influence policy processing or policy-controlled actions from a low-privileged context.
4. Trigger Group Policy processing through logon, reboot, scheduled refresh, or manual refresh behavior.
5. Obtain elevated local privileges, potentially administrator or SYSTEM.
6. Use elevated access to disable protections, dump credentials, establish persistence, or move laterally.

How to detect it

Because this is a local privilege-escalation issue and no public exploit maturity or CVE-specific exploit artifacts are provided, detection should focus on behavioral evidence around Group Policy processing followed by privilege gain. Review Windows Security logs, Microsoft-Windows-GroupPolicy/Operational logs, System logs, PowerShell logs, Sysmon or EDR telemetry, and endpoint protection alerts. Look for unusual Group Policy refreshes, policy processing errors, unexpected changes to local administrators or privileged groups, creation of new services or scheduled tasks, registry changes to policy-controlled areas, security tool tampering, and suspicious process chains involving Group Policy utilities. Key Windows events to review include local account creation, group membership changes, privilege assignment changes, service installation, scheduled task creation, logon type changes, and audit policy changes. Prioritize hosts where a non-administrative user session is followed shortly by administrative actions, SYSTEM-level process creation, credential access attempts, or lateral movement.

• Microsoft-Windows-GroupPolicy/Operational
• gpupdate.exe /force
• secedit.exe
• LGPO.exe
• Event ID 4720
• Event ID 4728
• Event ID 4732
• Event ID 4738
• Event ID 4739
• Event ID 4697
• Event ID 7045
• Event ID 4698
• Event ID 4702
• Event ID 4670
• Event ID 4672
• Event ID 4719
• net localgroup administrators
• net.exe localgroup administrators
• powershell.exe Add-LocalGroupMember
• schtasks.exe /Create
• sc.exe create
• reg.exe add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies
• C:\Windows\System32\GroupPolicy\Machine\Registry.pol
• C:\Windows\System32\GroupPolicy\User\Registry.pol

What your security team should do

• Inventory all affected Windows client and server versions and identify unpatched systems.
• Patch high-risk systems first: servers, domain-joined endpoints, privileged access workstations, jump hosts, VDI images, and systems used by administrators.
• Review local administrator group membership and remove unnecessary privileged users before and after patching.
• Increase monitoring for suspicious Group Policy activity, privilege changes, new local administrators, service creation, scheduled task creation, and endpoint security tampering.
• Hunt for signs of prior local privilege escalation on systems where low-privileged users had interactive access.
• Use EDR controls to alert on unusual use of gpupdate.exe, secedit.exe, powershell.exe, schtasks.exe, sc.exe, net.exe, and reg.exe when followed by privilege or persistence changes.
• Ensure endpoint protection, credential theft protections, LSASS hardening, and tamper protection are enabled on affected systems.
• Track Microsoft guidance for fixed build numbers or superseding cumulative updates and update vulnerability management logic accordingly.