EUVD-2026-43923
GHSA-56fw-c5xp-6pv2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Local vector with low privileges matches description; C:H reflects security feature bypass enabling data access; I:L for limited write-side effect; A:N as no disruption is described.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper access control in Windows System allows an unauthorized attacker to bypass a security feature locally.
AnalysisAI
Security feature bypass in the Windows System component on Windows 11 and Windows Server allows an authenticated local attacker with standard user privileges to circumvent an access control protection, yielding high confidentiality exposure and limited integrity impact. Affected platforms span Windows 11 versions 24H2 through 26H1 and Windows Server 2022 and 2025. No public exploit has been identified and CISA SSVC rates exploitation as none with non-automatable delivery, making this a moderate-priority local threat despite the high confidentiality impact signal in the CVSS vector.
Technical ContextAI
The vulnerability resides in the Windows System component, a core part of the Microsoft Windows operating system present across both client and server editions. Rooted in CWE-284 (Improper Access Control), the flaw occurs when the OS fails to enforce proper permission or boundary checks, permitting a low-privileged caller to bypass a security enforcement mechanism - likely a kernel-mode or system-service-level control that is expected to restrict access to sensitive resources. CPE strings confirm the issue spans Windows 11 24H2 (builds 10.0.26100.x), 25H2 (10.0.26200.x), and 26H1 (10.0.28000.x), as well as Windows Server 2022 (10.0.20348.x) and Windows Server 2025 (10.0.26100.x) including Server Core installations. Improper access control at this level typically reflects insufficient validation of caller identity or privilege token before granting access to protected objects, system calls, or configuration state.
RemediationAI
Apply the Microsoft-released patch for CVE-2026-50418 as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50418. The confirmed fixed builds are: Windows 11 24H2 at 10.0.26100.8875 or later, Windows 11 25H2 at 10.0.26200.8875 or later, Windows 11 26H1 at 10.0.28000.2269 or later, Windows Server 2022 at 10.0.20348.5386 or later, and Windows Server 2025 and Server Core at 10.0.26100.33158 or later, all available via Windows Update or WSUS. For environments where patching must be deferred, restrict local interactive logon to trusted privileged accounts only using Group Policy (Deny log on locally), audit and remove unnecessary low-privileged local accounts, and enforce application control via Windows Defender Application Control (WDAC) to limit arbitrary code execution opportunities - noting that these compensating controls reduce exposure but do not eliminate the underlying flaw. The SSVC non-automatable rating provides some scheduling flexibility for patch deployment, though Windows Server environments with multiple concurrent user sessions should prioritize this update.
More in Windows Server 2022
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today