What is the CVSS score of CVE-2026-50378?

CVE-2026-50378 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows Key Guard are affected by CVE-2026-50378?

Windows Key Guard (affecting Windows 10, 11, and Server 2019-2025) contains a local privilege escalation vulnerability that allows already-authenticated users to elevate permissions through a race…. A patch is available.

How to fix or mitigate CVE-2026-50378?

Within 24 hours, inventory all Windows 10, Windows 11, and Windows Server 2019-2025 systems in your environment to establish baseline exposure. Within 7 days, begin deploying Microsoft's released security patches for Windows Key Guard across development and test environments first, then proceed to production systems in phases by business criticality. Complete patching of all affected systems within 30 days, with priority given to systems hosting sensitive applications and administrative functions; verify patch deployment through Windows Update confirmations and endpoint security scanning.

Windows Key Guard CVE-2026-50378

EUVD-2026-43925 HIGH

Race Condition (CWE-362)

2026-07-14 microsoft

GHSA-p52g-fgpm-gpx8

Information Disclosure Race Condition Microsoft Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation

7.0

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today AI

7.0 HIGH

Local, already-authenticated low-priv attacker (AV:L/PR:L) must win a non-deterministic timing race (AC:H); successful escalation yields full system control, so C/I/A all High.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 20, 2026 - 17:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 20, 2026 - 17:52 vuln.today

cvss_changed

CVSS changed

Jul 20, 2026 - 17:52 NVD

7.8 (HIGH) 7.0 (HIGH)

Analysis Generated

Jul 14, 2026 - 21:09 vuln.today

CVE Published

Jul 14, 2026 - 17:07 nvd

HIGH 7.8

DescriptionNVD

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Key Guard allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Windows Key Guard affects all supported Windows 10, Windows 11, and Windows Server releases (Server 2019 through 2025), where a race condition in the synchronization of a shared resource lets an already-authenticated local user win a timing window to elevate to higher privileges. Microsoft has released patches and rates it Important (CVSS 7.0); there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none, though the technical impact is rated total. EPSS is low at 0.24% (16th percentile), consistent with a high-complexity local flaw rather than a widely-scanned remote target.

Technical ContextAI

Windows Key Guard is a Windows platform security component involved in protecting cryptographic key material. The root cause is CWE-362, a concurrent execution flaw using a shared resource with improper synchronization ('race condition'): two or more threads/processes access shared state without adequate locking, creating a time-of-check-to-time-of-use window an attacker can exploit to manipulate privileged operations. The CPE set (cpe:2.3:a:microsoft:windows_10_version_1809 through windows_server_2025) confirms this is a core operating-system-level component present across the entire modern Windows codebase rather than an optional add-on, which is why every current client and server SKU is enumerated as affected.

RemediationAI

Apply the Microsoft security update: Vendor-released patch is available, with fixed builds of 10.0.17763.9020 (1809 / Server 2019), 10.0.19044.7548 (21H2), 10.0.19045.7548 (22H2), 10.0.20348.5386 (Server 2022), 10.0.26100.8875 (Windows 11 24H2), 10.0.26200.8875 (25H2), 10.0.28000.2269 (26H1), and 10.0.26100.33158 (Server 2025) - install the relevant cumulative update via Windows Update or your patch-management tooling, guided by the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50378. Microsoft has not published a supported workaround for this component, so patching is the only reliable fix; as an interim compensating control, restrict interactive and local logon rights so untrusted users cannot run code on affected hosts (most impactful on shared/RDS/terminal-server and jump-box systems), and monitor for anomalous local process behavior - noting these controls reduce exposure but do not remediate the underlying race condition. Prioritize multi-user and Server Core hosts where low-privileged local access is more likely.