Windows Group Policy CVE-2026-50391

Exploitation requires the attacker to already have authenticated local access to the affected Windows system with at least low-level privileges (CVSS PR:L), meaning a valid standard-user session or equivalent foothold on the host - it cannot be triggered remotely or by an unauthenticated party. The vulnerable component is Windows Group Policy processing, present by default across the affected Windows 10, Windows 11, and Windows Server 2012-2025 builds, so no special non-default feature toggle is documented as a prerequisite in the available data. Limiting factors that reduce real-world risk: the local-only attack vector (AV:L) rules out network exploitation, no user interaction of a second party is involved (UI:N), and the attacker must first obtain a local account or code execution on the target before this bug can be used to elevate.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally exploitable, low-complexity flaw that requires the attacker to already hold some privileges (PR:L) but no user interaction, yielding full C/I/A impact within an unchanged scope. No EPSS score, KEV entry, or POC availability was supplied, so exploitation probability cannot be quantified from the input; by the precision rules this is 'no public exploit identified at time of analysis' and it is not confirmed actively exploited. This is a realistic but not emergency priority: the local-access requirement caps mass-exploitation potential, yet privilege-escalation bugs of this class are highly valued as the second stage of an intrusion chain, and the very broad Windows footprint means near-universal exposure. The one caveat to verify: the description says 'authorized attacker' while the CPEs are tagged as application (a:) rather than operating-system (o:) entries - this is a Microsoft OS component, so treat the CPE 'a' designation as a cataloguing artifact, not a change in attack surface.

An attacker who has already gained a low-privileged foothold on a Windows host - for example through phishing, a stolen standard-user credential, or a compromised service account - invokes the flawed Group Policy processing path to escalate to SYSTEM. Because the CVSS vector is AV:L/AC:L/PR:L/UI:N, the exploit runs entirely locally, needs no victim interaction, and is low-complexity once initial access exists, after which the attacker can install persistence, disable security tooling, or move laterally. No public exploit code was identified at time of analysis.