Severity by source
AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Adjacent-network improper-authentication EoP needing no credentials (PR:N) but user interaction (UI:R), with full CIA impact and no scope change, matches the reported vector.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network.
AnalysisAI
Elevation of privilege in the Microsoft Windows RPC API lets an unauthenticated attacker on an adjacent network gain higher privileges by exploiting an improper authentication weakness (CWE-287), provided a user is lured into an interaction. The flaw spans a broad range of client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10 1607 through Windows 11 26H1. No public exploit identified at time of analysis; the issue was reported by Microsoft, which has released a fix.
Technical ContextAI
The vulnerability lives in Windows Remote Procedure Call (RPC), the core inter-process and cross-host communication mechanism that underpins many Windows services (SMB-adjacent services, DCOM, service control, and management interfaces). The root cause is classified as CWE-287 Improper Authentication, meaning the RPC endpoint fails to correctly verify the identity or authorization of a caller, allowing an actor without valid credentials to be treated as a more privileged principal. Because RPC is a foundational OS component, the affected CPE set covers essentially the full supported Windows lineage: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 including Server Core installations.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-50365 via Windows Update or WSUS/SCCM as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50365, prioritizing domain controllers, member servers, and any systems reachable from less-trusted network segments. Exact fixed build numbers are not enumerated in the input, so match the KB to each OS version from the MSRC page. As compensating controls until patching completes, restrict RPC reachability by segmenting VLANs and enforcing host firewall rules that limit inbound RPC endpoint mapper (TCP 135) and dynamic RPC ports to trusted management hosts only - note this can break legitimate management, remote administration, and clustering traffic if scoped too tightly. Since exploitation requires user interaction over an adjacent network, also reinforce user awareness and reduce exposure of workstations to untrusted local network segments (guest Wi-Fi, shared LANs).
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-43944
GHSA-wfq2-654c-4wx2