Windows RPC CVE-2026-50365

Exploitation requires the attacker to be on an adjacent network (same broadcast domain/subnet or logically adjacent segment, per AV:A) with reachability to the target's Windows RPC interface, and it requires user interaction (UI:R) on the victim system to trigger the vulnerable code path - the attacker cannot succeed purely by sending unsolicited traffic. No valid credentials are needed (PR:N), and attack complexity is low (AC:L). Limiting factors that reduce realistic risk: the mandatory adjacency (not exploitable directly from the internet), the required user action, and the need for RPC ports to be reachable; environments that segment RPC and isolate untrusted hosts substantially raise the bar.

The CVSS 3.1 base score is 8.0 (High) with vector AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating an adjacent-network, low-complexity attack needing no prior privileges but requiring user interaction, yielding high confidentiality, integrity, and availability impact. The adjacency requirement (AV:A) and mandatory user interaction (UI:R) meaningfully constrain mass exploitation compared to a fully remote, no-interaction bug, pushing this toward opportunistic or targeted lateral-movement use rather than internet-wide scanning. No EPSS score, KEV entry, or SSVC decision data was provided, and no proof-of-concept is referenced, so exploitation probability cannot be quantified from the input. The combination of unauthenticated access (PR:N), full CIA impact, and Windows' ubiquity still makes this a credible priority for patching, but the raw 8.0 overstates internet-exposure risk given the adjacent-network and user-interaction gates - treat it as an internal/lateral-movement threat.

An attacker who has gained a foothold on the same LAN or subnet as a target Windows host crafts malicious RPC traffic and induces a user on the target to perform an action that triggers the vulnerable RPC path, bypassing authentication to execute operations at elevated privilege. Given AV:A and AC:L, the attack is technically straightforward once the attacker is adjacent and the user interaction occurs, enabling lateral movement or privilege escalation. No public proof-of-concept is identified at time of analysis.