EUVD-2026-43944
GHSA-wfq2-654c-4wx2
Severity by source
AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Adjacent-network improper-authentication EoP needing no credentials (PR:N) but user interaction (UI:R), with full CIA impact and no scope change, matches the reported vector.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network.
AnalysisAI
Elevation of privilege in the Microsoft Windows RPC API lets an unauthenticated attacker on an adjacent network gain higher privileges by exploiting an improper authentication weakness (CWE-287), provided a user is lured into an interaction. The flaw spans a broad range of client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10 1607 through Windows 11 26H1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be on an adjacent network (same broadcast domain/subnet or logically adjacent segment, per AV:A) with reachability to the target's Windows RPC interface, and it requires user interaction (UI:R) on the victim system to trigger the vulnerable code path - the attacker cannot succeed purely by sending unsolicited traffic. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 8.0 (High) with vector AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating an adjacent-network, low-complexity attack needing no prior privileges but requiring user interaction, yielding high confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained a foothold on the same LAN or subnet as a target Windows host crafts malicious RPC traffic and induces a user on the target to perform an action that triggers the vulnerable RPC path, bypassing authentication to execute operations at elevated privilege. Given AV:A and AC:L, the attack is technically straightforward once the attacker is adjacent and the user interaction occurs, enabling lateral movement or privilege escalation. … |
| Remediation | Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-50365 via Windows Update or WSUS/SCCM as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50365, prioritizing domain controllers, member servers, and any systems reachable from less-trusted network segments. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows Server 2012-2025 and Windows 10 1607 through Windows 11 26H1 systems in your environment and download the latest Microsoft security patch. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Windows 10 Version 1607
View allLocal privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Win32K kernel subsystem (CWE-122 heap-based buffer overflow) lets an already-a
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local code execution in the Microsoft Message Queuing (MSMQ) Queue Manager affects a broad range of Windows client and s
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Elevation of privilege in the Windows NTFS file-system driver lets an already-authenticated local user escalate to SYSTE
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in the Windows Server Network driver stems from a race condition (CWE-362) that lets an unauthoriz
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Remote code execution in Microsoft Windows Message Queuing (MSMQ) allows an unauthenticated attacker to run arbitrary co
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today