Windows Server CVE-2026-50311

Exploitation requires the attacker to already possess authenticated local access to an affected Windows host (CVSS PR:L, AV:L) - a standard/limited user account or code execution in a low-privilege context is the prerequisite; there is no remote or network-facing path. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local access is held, escalation to full SYSTEM-level compromise (C:H/I:H/A:H) is straightforward. Limiting factors: the vulnerability cannot be triggered by an unauthenticated remote attacker, it depends on the target running an affected Windows build (Windows 10/11 client versions or Server 2012-2025 as listed), and it is a second-stage primitive that presumes an existing foothold. The description's exact affected feature is not enumerated beyond 'improper access control,' so the specific vulnerable component should be confirmed via the Microsoft advisory.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.8 (High): local attack vector, low complexity, low privileges, no user interaction, and full high impact to confidentiality, integrity, and availability - a classic local privilege-escalation profile. There is no EPSS score, no KEV listing, and no POC in the provided data, so exploitation probability signals are absent; the risk is therefore driven by the impact and ease-of-exploit metrics rather than by evidence of in-the-wild activity. The requirement for existing local access (PR:L, AV:L) meaningfully limits this to attackers who already have a foothold, so it is a strong second-stage/escalation primitive rather than an initial-access threat. Note a data tension worth flagging: the description says 'Windows Server' and 'authorized attacker,' while the CPE list and tags also enumerate Windows 10/11 client builds - verify client applicability against Microsoft's advisory rather than assuming server-only scope.

An attacker who already holds a low-privileged local account or has landed code on the host through phishing or a separate bug abuses the improper access control check to elevate to SYSTEM, then disables security tooling, harvests credentials, and moves laterally. Because the CVSS vector is AV:L/AC:L/PR:L/UI:N, exploitation is low-complexity and requires no victim interaction once local access exists. No public exploit code is identified at time of analysis, so a working exploit would need to be developed or acquired.