What is the CVSS score of CVE-2026-49176?

CVE-2026-49176 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows WalletService are affected by CVE-2026-49176?

Microsoft Windows WalletService contains a local privilege escalation vulnerability (CVE-2026-49176, CVSS 7.8) enabling authenticated low-privilege users to gain SYSTEM-level access on affected…. A patch is available.

Is there a public PoC exploit available for CVE-2026-49176?

Yes, a public proof-of-concept exploit is available for CVE-2026-49176. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-49176?

Within 24 hours, inventory all Windows systems running WalletService and determine affected client and server builds against CVE-2026-49176. Within 7 days, obtain the vendor patch from Microsoft and begin coordinated deployment to critical systems first (servers, administrative workstations, internet-facing endpoints). Within 30 days, complete patching of all client and server endpoints, validate patch installation through your endpoint management platform, and verify WalletService version updates on a sample of deployed systems.

Windows WalletService CVE-2026-49176

EUVD-2026-43984 HIGH

Improper Privilege Management (CWE-269)

2026-07-14 microsoft

GHSA-q78x-6ffp-9vhr

Privilege Escalation Microsoft Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local privilege escalation from a low-privileged account (AV:L/PR:L), no interaction and low complexity, yielding full SYSTEM control so C:H/I:H/A:H within an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 17:42 vuln.today

CVE Published

Jul 14, 2026 - 17:04 nvd

HIGH 7.8

DescriptionCVE.org

Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows WalletService allows an authenticated low-privileged attacker to gain SYSTEM-level rights on the host, per CVSS:3.1 AV:L/AC:L/PR:L (7.8, High). The flaw stems from improper privilege management (CWE-269) in the WalletService component and affects a broad range of Windows client and server builds. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch from Microsoft is available.

Technical ContextAI

WalletService is a Windows system service (WalletService.dll, hosted under svchost.exe) that backs the Microsoft Wallet / payment and credential storage functionality. The root cause is CWE-269 (Improper Privilege Management): the service fails to correctly enforce or drop privileges, allowing an already-authenticated local principal to perform actions in a higher security context than intended. The CPE data confirms the defect lives in the Microsoft-shipped operating system components across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1) and Windows Server (2016, 2019, 2022, 2025), including Server Core installations, meaning it is an OS-level issue rather than an optional add-on.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security updates referenced in the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49176, selecting the cumulative update / KB that matches each affected build (Windows 10 1607-22H2, Windows 11 24H2-26H1, Windows Server 2016-2025 including Server Core). Exact fixed file versions are enumerated per build in the MSRC page and should be pulled from there rather than assumed. As WalletService has no supported disable switch and is an OS component, the primary control is prompt deployment of the monthly cumulative update via WSUS/Intune/SCCM; where immediate patching is impossible, reduce exposure by limiting interactive and remote-interactive logon rights so fewer low-privileged accounts can run local code, and monitor for anomalous child processes or token manipulation around svchost-hosted WalletService - recognizing these are detective/limiting controls, not a fix, and do not remove the underlying flaw.