Skip to main content

Severity by source

Vendor (microsoft) PRIMARY
8.0 HIGH
AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CIRCL (temporal)
7.0 HIGH
cvss
vuln.today AI
8.0 HIGH

Adjacent-network improper-authentication EoP needing no credentials (PR:N) but user interaction (UI:R), with full CIA impact and no scope change, matches the reported vector.

3.1 AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 14, 2026 - 21:25 vuln.today
CVE Published
Jul 14, 2026 - 17:07 cve.org
HIGH 8.0

DescriptionCVE.org

Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network.

AnalysisAI

Elevation of privilege in the Microsoft Windows RPC API lets an unauthenticated attacker on an adjacent network gain higher privileges by exploiting an improper authentication weakness (CWE-287), provided a user is lured into an interaction. The flaw spans a broad range of client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10 1607 through Windows 11 26H1. No public exploit identified at time of analysis; the issue was reported by Microsoft, which has released a fix.

Technical ContextAI

The vulnerability lives in Windows Remote Procedure Call (RPC), the core inter-process and cross-host communication mechanism that underpins many Windows services (SMB-adjacent services, DCOM, service control, and management interfaces). The root cause is classified as CWE-287 Improper Authentication, meaning the RPC endpoint fails to correctly verify the identity or authorization of a caller, allowing an actor without valid credentials to be treated as a more privileged principal. Because RPC is a foundational OS component, the affected CPE set covers essentially the full supported Windows lineage: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 including Server Core installations.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-50365 via Windows Update or WSUS/SCCM as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50365, prioritizing domain controllers, member servers, and any systems reachable from less-trusted network segments. Exact fixed build numbers are not enumerated in the input, so match the KB to each OS version from the MSRC page. As compensating controls until patching completes, restrict RPC reachability by segmenting VLANs and enforcing host firewall rules that limit inbound RPC endpoint mapper (TCP 135) and dynamic RPC ports to trusted management hosts only - note this can break legitimate management, remote administration, and clustering traffic if scoped too tightly. Since exploitation requires user interaction over an adjacent network, also reinforce user awareness and reduce exposure of workstations to untrusted local network segments (guest Wi-Fi, shared LANs).

CVE-2026-33824 CRITICAL POC
9.8 Apr 14

Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen

CVE-2026-56155 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p

CVE-2026-32202 MEDIUM POC
4.3 Apr 14

Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n

CVE-2026-49798 CRITICAL POC
9.3 Jul 14

Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve

CVE-2026-54128 HIGH POC
8.4 Jul 14

Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff

CVE-2026-50518 CRITICAL
9.8 Jul 14

Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr

CVE-2026-50655 HIGH POC
7.8 Jul 14

Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug

CVE-2026-54992 HIGH POC
7.8 Jul 14

Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component

CVE-2026-50489 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem

CVE-2026-50667 HIGH POC
7.0 Jul 14

Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c

CVE-2026-57092 CRITICAL
9.9 Jul 14

Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating

CVE-2026-56190 CRITICAL
9.8 Jul 14

Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary

Share

CVE-2026-50365 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy