Microsoft Windows CVE-2026-50335

Exploitation requires the attacker to already hold valid low-privileged local access to the target Windows host (CVSS PR:L), the ability to execute code locally (AV:L - no remote or network path), and no user interaction (UI:N). The flaw affects default installations of the listed Windows client and server versions, so no special non-default feature or configuration is called out in the description; the primary limiting factor is that the attacker must first obtain an authenticated foothold on the machine, meaning this cannot be used for initial access and is only a post-compromise privilege-escalation step. Applicable only to the enumerated Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: local attack vector, low complexity, low privileges required, no user interaction, and full high impact to all three properties. This is a classic local privilege-escalation profile - not remotely exploitable, so it is not an initial-access vector, but a valuable second-stage capability once an attacker or malware has any authenticated foothold. No EPSS score, KEV listing, or POC signal is present in the provided data, so real-world exploitation is currently unproven; however, Windows EoP bugs of this class are routinely weaponized in post-exploitation chains and by commodity malware, so it warrants prioritization in normal Patch Tuesday cadence. There is no conflict among the available signals - the description ('elevate privileges locally') aligns cleanly with the AV:L/PR:L vector. EPSS and any active-exploitation telemetry are simply missing from this dataset, so priority rests on the confirmed vendor patch plus the broad Windows footprint rather than on demonstrated exploitation.

An attacker who has already obtained low-privilege access to a Windows host - for example via a phished user account, a compromised service account, or a foothold from another vulnerability - runs a crafted local operation that abuses the improper access control to bypass the authorization check and gain SYSTEM-level or administrative privileges. From there they disable security tooling, install persistence, and move laterally. No public proof-of-concept exploit is identified in the available data, but the low attack complexity and no-user-interaction requirement make reliable exploitation plausible once code execution as a normal user is achieved.