EUVD-2026-43927
GHSA-8p36-2272-5qg7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires an existing low-privileged local account (PR:L, AV:L) to trigger a reliable authorization bypass yielding SYSTEM-level control, so full C/I/A high, scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper authorization in RPC Runtime allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Windows RPC Runtime lets an already-authenticated low-privileged user gain SYSTEM-level control due to improper authorization (CWE-285). Affecting a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 26H1 and Server 2025, the flaw carries CVSS 7.8 with high confidentiality, integrity, and availability impact. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The Remote Procedure Call (RPC) Runtime is a core Windows subsystem (rpcrt4.dll) that marshals calls between processes and hosts, underpinning much of the operating system's inter-process and network service communication. The root cause is CWE-285 Improper Authorization: the runtime fails to correctly enforce access-control decisions on a privileged operation, so an authorized caller can invoke functionality that should be restricted. Because RPC endpoints frequently run in high-privilege contexts (services running as SYSTEM), an authorization gap in the runtime translates directly into a local elevation-of-privilege primitive. The affected CPEs enumerate Microsoft Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025 including Server Core installations.
RemediationAI
Apply the Microsoft security update for CVE-2026-50346 (Patch available per vendor advisory) via the Microsoft Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50346, selecting the specific fixed build for each affected client and server SKU during your normal patch cycle; the input does not disclose exact fixed version numbers, so pull them directly from the MSRC page rather than inventing them. Because RPC is a foundational Windows service, disabling it is not a practical workaround, so prioritize prompt patching. As interim compensating controls, restrict and monitor local logon access on high-value hosts (limiting who can obtain the low-privilege foothold this exploit requires), enforce least-privilege on service accounts, and use EDR/audit policies to watch for anomalous privilege-escalation behavior against RPC endpoints - accepting that these reduce but do not eliminate exposure until the patch is deployed.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today