Microsoft Windows CVE-2026-49800

Exploitation requires the attacker to already have a valid low-privilege local session on the target Windows machine (CVSS PR:L, AV:L) and the ability to reach the WPAD/proxy auto-discovery code path, which is present by default across the affected Windows client and server builds. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factor is that this is not remotely reachable on its own - the attacker must first obtain authenticated local execution - so it functions as a second-stage escalation rather than an initial-access vulnerability; environments that have explicitly disabled WPAD auto-discovery further reduce exposure.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable, low-complexity flaw requiring low existing privileges and no user interaction, yielding full confidentiality, integrity, and availability impact on the local host - the classic profile of a privilege-escalation primitive rather than a remote entry point. No EPSS score, no SSVC decision data, and no POC signal were provided, and the CVE is not in CISA KEV, so there is no evidence of active exploitation or automatable mass abuse. Real-world priority is moderate-to-high: it is not a standalone remote threat, but as a local EoP in a component shipped on virtually every supported Windows system it is a valuable second-stage tool for attackers who already have a foothold, so it belongs in the standard Patch Tuesday remediation cycle. Note the reporter is Microsoft itself, which typically indicates internal discovery rather than in-the-wild detection.

An attacker who already holds a low-privileged foothold on a Windows host - for example via a phished user account or a compromised low-rights service - invokes the WPAD code path with crafted input that triggers the integer overflow, corrupting memory in a privileged context and escalating to SYSTEM. With AV:L/AC:L/PR:L/UI:N the escalation is reliable, requires no victim interaction, and needs only local access. No public POC has been identified, so any exploitation would currently require independent development.