CVE-2026-50672

What it actually does

CVE-2026-50672 is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows NTFS file system driver. A low-privileged, authenticated local attacker who can run code on an affected Windows system may be able to trigger unsafe reuse of freed kernel memory and execute code with elevated privileges, likely in kernel context or as SYSTEM. The CVSS vector indicates local access is required, exploitation complexity is high, and no user interaction is needed, but successful exploitation can compromise confidentiality, integrity, and availability of the affected host.

Why it matters to the business

Successful exploitation can turn an initial low-privileged foothold on a Windows workstation or server into full system control. This can enable credential theft, disabling of security tools, persistence installation, lateral movement, data theft, ransomware staging, or destructive actions. Because the issue affects multiple supported Windows client and server versions, including Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025, organizations with broad Windows fleets should treat remediation as a priority even though the vulnerability is not currently listed in CISA KEV and no public exploit maturity is reported.

How an attack unfolds

An attacker first obtains the ability to execute code as a low-privileged local user, commonly through phishing, stolen credentials, exploitation of an internet-facing application, remote access abuse, or malware already running on the endpoint. The attacker then runs a crafted local exploit that interacts with NTFS in a way that triggers the use-after-free condition. Because the vulnerable code is in the file system layer, exploitation would typically involve carefully timed file, directory, volume, reparse point, handle, or metadata operations designed to influence kernel memory reuse after an object has been freed. If the attacker wins the required race or heap-shaping conditions, they can corrupt or control kernel memory and elevate privileges. With elevated privileges, the attacker can dump credentials, install persistence, tamper with endpoint protection, access sensitive local data, and use the host as a platform for lateral movement or broader compromise.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-50672 for all affected Windows versions as soon as it becomes available through Windows Update, WSUS, Microsoft Update Catalog, Intune, Configuration Manager, or other enterprise patching systems. Affected platforms include Windows 10 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; Windows Server 2019; Windows Server 2022; and Windows Server 2025. No specific fixed build numbers were provided in the input, so administrators should verify remediation using Microsoft’s official Security Update Guide and installed cumulative update/build information for each supported OS version. Where immediate patching is not possible, reduce exposure by enforcing least privilege, preventing untrusted local code execution, restricting interactive logon to servers, hardening application control policies, monitoring for suspicious local exploit behavior, and ensuring endpoint protection and tamper protection are enabled.

How to confirm the fix worked

Confirm that each affected system has installed the relevant Microsoft cumulative security update for its Windows release after the July 2026 security update publication date. Validate OS build and patch state using centralized patch management, vulnerability scanning, Microsoft Defender Vulnerability Management, authenticated configuration scans, or PowerShell inventory of installed hotfixes and build numbers. Because this is a local privilege escalation flaw, exposure validation should focus on Windows systems that are missing the applicable cumulative update and allow low-privileged users, service accounts, remote desktop users, or application workloads to execute local code. After remediation, rerun authenticated vulnerability scans and confirm the vulnerability is no longer reported for Windows 10, Windows 11, and Windows Server assets in scope.

Typical attack path

1. Gain initial access to an affected Windows workstation or server as a low-privileged authenticated user.
2. Transfer or generate a local privilege escalation exploit on the host.
3. Execute crafted NTFS file system operations to trigger the use-after-free condition.
4. Manipulate kernel memory timing or object reuse to achieve privileged code execution.
5. Spawn a high-privilege process or modify security-sensitive tokens, services, or kernel structures.
6. Disable defenses, collect credentials, establish persistence, or move laterally using the newly elevated privileges.

How to detect it

Investigate whether low-privileged accounts executed unusual binaries or scripts shortly before gaining administrative or SYSTEM-level privileges. Useful log sources include Windows Security logs, Sysmon, Microsoft Defender for Endpoint, EDR telemetry, PowerShell logs, service control manager events, scheduled task logs, Windows Defender operational logs, and file system telemetry where available. Look for suspicious parent-child process relationships such as a user-writable executable spawning cmd.exe, powershell.exe, conhost.exe, rundll32.exe, reg.exe, sc.exe, net.exe, whoami.exe, or a service running as LocalSystem. Review Windows Security Event IDs 4688 for process creation, 4672 for special privileges assigned to new logons, 4624 for new logons, 4697 for service installation, 4698 for scheduled task creation, 7045 in the System log for new service creation, and Sysmon Event IDs 1, 11, 12/13/14, and 15 where enabled. Because no public exploit indicators are provided, detection should be behavior-based: focus on abnormal NTFS manipulation from temporary or user-writable paths, sudden privilege transitions, exploit-like process crashes, kernel bugchecks, tampering with EDR services, credential dumping after privilege escalation, and creation of persistence immediately after a low-privileged process runs.

• Windows Security Event ID 4672: Special privileges assigned to new logon
• Windows Security Event ID 4688: New Process Created
• Windows Security Event ID 4697: A service was installed in the system
• Windows Security Event ID 4698: A scheduled task was created
• System Event ID 7045: A service was installed in the system
• Sysmon Event ID 1: Process Create
• Sysmon Event ID 11: FileCreate
• Sysmon Event ID 12: Registry object created or deleted
• Sysmon Event ID 13: Registry value set
• Sysmon Event ID 14: Registry object renamed
• Sysmon Event ID 15: FileCreateStreamHash
• \Windows\Temp\
• \Users\Public\
• \ProgramData\
• \AppData\Local\Temp\
• sc.exe create
• schtasks.exe /create
• whoami.exe /priv
• cmd.exe /c whoami
• powershell.exe -ExecutionPolicy Bypass
• vssadmin.exe delete shadows
• bcdedit.exe /set {default} safeboot
• reg.exe add HKLM\SYSTEM\CurrentControlSet\Services
• net localgroup administrators

What your security team should do

• Prioritize patching servers, shared workstations, VDI images, developer systems, jump hosts, and endpoints where low-privileged users or exposed services can execute local code.
• Use Microsoft’s Security Update Guide to map each affected Windows version to the exact cumulative update or fixed build, then deploy through standard enterprise patch channels.
• Hunt for signs of recent local privilege escalation, especially low-privileged processes spawning SYSTEM shells, creating services, modifying security tooling, or performing unusual NTFS-heavy operations.
• Restrict local administrator rights and interactive logon rights, particularly on Windows servers and high-value workstations.
• Enforce application control, script control, and endpoint detection policies to reduce the likelihood that a local exploit binary can run.
• Monitor for suspicious file-system manipulation patterns involving reparse points, hard links, volume shadow copies, raw disk access, or abnormal handle activity from user-writable directories.
• Ensure EDR tamper protection is enabled and alert on attempts to stop, disable, or reconfigure security services after a privilege change.
• Track exploit availability; while exploit maturity is currently reported as none and the vulnerability is not in CISA KEV, local privilege escalation flaws are commonly incorporated into post-compromise toolchains once proof-of-concept code appears.