What is the CVSS score of CVE-2026-50421?

CVE-2026-50421 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Windows are affected by CVE-2026-50421?

A local privilege escalation vulnerability in Windows DiagTrack (CVE-2026-50421) allows already-authenticated users to gain SYSTEM-level access across Windows 10, 11, and Server 2016-2025 editions.. A patch is available.

How to fix or mitigate CVE-2026-50421?

Within 24 hours, conduct an asset inventory to identify all Windows 10 (versions 1607 through 26H1), Windows 11, and Windows Server 2016-2025 systems in scope. Within 7 days, deploy Microsoft's security patch for CVE-2026-50421 across all affected systems using your established Windows Update, WSUS, or enterprise patch management tool. Within 30 days, verify patch deployment success through vulnerability scanning and endpoint compliance tools, document any exceptions unable to patch, and establish compensating controls for unpatched systems pending remediation.

Windows CVE-2026-50421

EUVD-2026-43950 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-14 microsoft

GHSA-xc3q-x7gf-f2j9

Information Disclosure Memory Corruption Microsoft Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local, low-complexity elevation requiring an existing low-privileged session (AV:L/AC:L/PR:L), no user interaction, yielding SYSTEM-level full C/I/A impact within an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:31 vuln.today

CVE Published

Jul 14, 2026 - 17:07 nvd

HIGH 7.8

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Connected User Experiences and Telemetry service (DiagTrack) lets an already-authenticated user run arbitrary code with SYSTEM-level rights by triggering a CWE-843 type-confusion condition. The flaw affects a broad range of currently-supported Windows client and server builds, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

The Connected User Experiences and Telemetry service (commonly known by its service name DiagTrack) is a built-in Windows component that collects and transmits diagnostic and usage telemetry to Microsoft; it runs as a privileged service on virtually every modern Windows installation. The root cause is CWE-843, access of a resource using an incompatible type ('type confusion'): the code interprets a piece of memory or an object as one type when it is actually another, causing the process to operate on a mis-typed pointer or structure. This is a memory-corruption class bug (as reflected in the vendor tags), and successful manipulation of the confused type allows an attacker to corrupt privileged process memory and redirect execution. Per the CPE data the affected code ships in Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2016/2019/2022/2025 including Server Core installations.

RemediationAI

Apply the Microsoft security update for CVE-2026-50421 (Vendor-released patch: available per the MSRC advisory) as the primary and definitive fix, selecting the cumulative update that matches each affected build; consult the exact KB/fixed-version details at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50421. Because the affected code is the Connected User Experiences and Telemetry (DiagTrack) service, an interim compensating control on hosts that cannot be patched immediately is to disable or stop the DiagTrack service (set the 'Connected User Experiences and Telemetry' service to Disabled), which removes the vulnerable attack surface at the cost of losing Windows diagnostic/telemetry data and may affect features that depend on it such as certain enterprise diagnostics and update-experience tooling. Since exploitation requires an authenticated local session, also limit interactive and low-privilege access on high-value multi-user systems to shrink the pool of potential attackers until patching completes.