CVE-2026-50509

What it actually does

This vulnerability is a local elevation-of-privilege flaw caused by unsafe deserialization of untrusted data in the Windows Wireless Wide Area Network Service. A low-privileged authenticated user on an affected Windows system can submit crafted data to the service and cause it to process attacker-controlled serialized content. Because the service runs with elevated Windows privileges, successful exploitation can allow the attacker to execute code or actions with high integrity, potentially as a privileged service context such as LOCAL SERVICE or SYSTEM depending on the vulnerable execution path. The CVSS vector indicates local access, low attack complexity, no user interaction, and high confidentiality, integrity, and availability impact.

Why it matters to the business

An attacker who already has a basic local foothold on an affected workstation or server could use this flaw to become an administrator, disable defenses, access sensitive data, tamper with systems, or deploy additional malware. This is especially relevant for Windows endpoints, remote-access workstations, shared systems, and servers where low-privileged accounts exist. Although it is not currently listed in CISA KEV and no public exploit maturity is reported, the vulnerability has a high severity score and affects multiple supported Windows client and server versions, so organizations should treat it as a priority local privilege-escalation patching item.

How an attack unfolds

An attacker first obtains local authenticated access to an affected Windows system, such as through stolen credentials, malware execution as a standard user, abuse of a low-privileged service account, or access to a shared workstation. The attacker then interacts with the Windows Wireless Wide Area Network Service using a crafted input that reaches the vulnerable deserialization logic. When the service deserializes attacker-controlled data, the attacker abuses that processing path to alter execution flow or cause privileged operations in the context of the service. After privilege escalation, the attacker typically runs commands with elevated privileges, creates or modifies local administrator accounts, dumps credentials, disables security tooling, installs persistence, or moves laterally using newly acquired privileges.

How to fix it

Apply the relevant Microsoft security updates or latest cumulative updates for all affected Windows versions: Windows 10 1607, 1809, 21H2, 22H2; Windows 11 24H2, 25H2, 26H1; Windows Server 2016, 2019, and 2025. No explicit fixed build numbers were provided in the input, so remediation should be validated against Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Intune, Configuration Manager, or the organization’s patch-management tooling. Where the Wireless Wide Area Network functionality is not required, consider disabling the WWAN AutoConfig service as a temporary risk-reduction measure, especially on servers and fixed workstations. Also reduce local privilege-escalation exposure by limiting interactive logon rights, removing unnecessary local users, enforcing least privilege, and ensuring endpoint protection is active and tamper-protected.

How to confirm the fix worked

Confirm that affected Windows systems have installed the Microsoft cumulative update or security update that remediates this vulnerability. Use enterprise patch-management inventory, vulnerability scanners, Microsoft Update compliance reports, or local commands such as Windows Update history, installed hotfix inventory, and OS build checks. Validate that all affected product versions are either patched, upgraded to a supported fixed build, or no longer exposed. On systems where mitigation is used instead of patching, confirm the WWAN AutoConfig service is disabled and cannot be started by non-administrative users. Re-scan representative assets after patch deployment and verify that vulnerability scanners no longer report exposure.

Typical attack path

1. Gain local authenticated access to an affected Windows 10, Windows 11, or Windows Server system.
2. Confirm the Windows Wireless Wide Area Network Service is present and reachable locally.
3. Send crafted data to the service path that performs unsafe deserialization.
4. Trigger privileged execution or privileged state manipulation through the vulnerable service.
5. Use the elevated privileges to launch commands, modify security settings, create persistence, access protected files, or dump credentials.
6. Use the compromised host as a platform for further lateral movement or post-exploitation activity.

How to detect it

To determine whether this vulnerability may have been exploited, review endpoint telemetry and Windows logs from affected systems for local privilege-escalation patterns around the Windows Wireless Wide Area Network Service. Focus on process creation events where a service-hosting svchost.exe instance associated with WWAN behavior spawns unusual child processes such as command shells, scripting engines, LOLBins, credential tools, or installers. Review Windows Security events for new privileged logons, assignment of special privileges, new local users, new local group membership, and suspicious administrative actions shortly after activity involving the WWAN service. Useful Windows events include Security 4688 for process creation, 4624 for logon activity, 4672 for special privileges assigned, 4720 for local user creation, 4732 for local group membership changes, 7045 from the System log for new service installation, and PowerShell operational logs for script execution. Review Sysmon events, if available, including process creation, image load, file creation, process access, and network connection telemetry. Also inspect Windows Error Reporting, application crash logs, and service control events for crashes or restarts of the WWAN AutoConfig service that precede privilege changes. Since no public exploit maturity or KEV listing is reported, detection should emphasize behavioral evidence rather than a known exploit signature.

• WwanSvc
• WWAN AutoConfig
• Microsoft-Windows-WWAN-SVC-Events
• svchost.exe -k LocalServiceNetworkRestricted
• Event ID 4688
• Event ID 4672
• Event ID 4720
• Event ID 4732
• Event ID 7045
• powershell.exe
• pwsh.exe
• cmd.exe
• wscript.exe
• cscript.exe
• rundll32.exe
• regsvr32.exe
• msiexec.exe
• schtasks.exe
• net.exe localgroup administrators
• net.exe user
• C:\Windows\System32\wwansvc.dll
• C:\Windows\System32\svchost.exe

What your security team should do

• Prioritize patching internet-adjacent workstations, administrator workstations, shared endpoints, jump hosts, remote-access systems, and servers where low-privileged users can log on.
• Deploy the latest Microsoft cumulative/security updates for all affected Windows client and server versions and track completion through centralized patch compliance reporting.
• If WWAN capability is not required, disable the WWAN AutoConfig service as a compensating control until patching is complete.
• Hunt for signs of local privilege escalation on affected systems, especially unusual child processes spawned from service-hosting svchost.exe instances, new local administrators, credential-dumping activity, and security-control tampering.
• Review local user and service-account privileges; remove unnecessary interactive logon rights and local administrator membership.
• Enable or tune detections for suspicious service behavior, process creation, account creation, privilege assignment, and endpoint protection disabling events.
• Because the issue is 28 days old and affects many Windows versions, escalate remediation for systems that remain unpatched beyond normal patch windows even though it is not currently in CISA KEV.