What is the CVSS score of CVE-2026-50328?

CVE-2026-50328 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.2%.

Which versions of WSUS are affected by CVE-2026-50328?

A denial-of-service vulnerability in Windows Server Update Services (WSUS) allows unauthenticated remote attackers to crash the update service, affecting Windows Server 2012-2025 and Windows 10…. A patch is available.

How to fix or mitigate CVE-2026-50328?

Within 24 hours, identify and inventory all WSUS server instances running versions 2012 through 2025, document current patch levels, and assess network exposure to untrusted networks. Within 7 days, apply the vendor-released patch per Microsoft's advisory to all affected WSUS servers, prioritizing those managing the largest Windows infrastructure fleets. Within 30 days, complete full regression testing to confirm update functionality, deploy to production across all sites, and implement network segmentation restricting WSUS access to authorized administrative subnets only.

WSUS CVE-2026-50328

EUVD-2026-43856 HIGH

Uncaught Exception (CWE-248)

2026-07-14 microsoft

GHSA-c7hq-7wfr-2j8f

Authentication Bypass Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.5 HIGH

Network-reachable WSUS listener needs no auth or user interaction (AV:N/AC:L/PR:N/UI:N); an uncaught exception crashes the service, giving availability-only impact (A:H, C:N/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 21:45 vuln.today

CVE Published

Jul 14, 2026 - 17:06 nvd

HIGH 7.5

DescriptionCVE.org

Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.

AnalysisAI

Denial of service in Microsoft Windows Server Update Services (WSUS) lets a remote, unauthenticated attacker crash or disrupt the update service by triggering an uncaught exception over the network. The flaw affects WSUS across Windows Server 2012 through 2025 (plus Windows 10 1607/1809 servicing components), and the CVSS 3.1 availability-only vector (A:H) indicates service unavailability rather than data compromise. No public exploit identified at time of analysis, but a vendor patch is available and the flaw is network-reachable without authentication.

Technical ContextAI

WSUS is the Microsoft Windows Server role that centrally distributes, approves, and deploys operating system and application updates to managed clients within an enterprise. The root cause is classified as CWE-248 (Uncaught Exception): a network-facing WSUS code path receives input it does not validate or handle, raising an exception that is never caught and propagates until the handling thread or process terminates abnormally. Because WSUS listens for client and management traffic over the network, a malformed or unexpected request can reach the vulnerable handler. The affected CPEs enumerate the WSUS server role on Windows Server 2012, 2012 R2, 2016, and 2019 (including Server Core installations) plus servicing entries for Windows 10 1607/1809, and the tags extend coverage to Windows Server 2022 and 2025.

RemediationAI

Apply the Microsoft security update for CVE-2026-50328; Patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50328, though the exact fixed KB/build is not in the provided data and must be pulled from that MSRC page for your specific Windows Server version. Until patched, reduce exposure by restricting network access to the WSUS ports (default TCP 8530 for HTTP and 8531 for HTTPS, or 80/443 on legacy setups) so only trusted management subnets and managed clients can reach the server - this blocks untrusted networks but does not protect against a malicious internal client. If WSUS is not required on a given host, disabling or decommissioning the role removes the attack surface entirely at the cost of losing centralized update distribution. Do not expose WSUS directly to the internet.