Windows CVE-2026-50421

Exploitation requires the attacker to already possess an authenticated local session on the target (CVSS PR:L, AV:L) - this is a local elevation-of-privilege bug, not a remote one, so it cannot be triggered over the network or without a prior foothold. The concrete prerequisite is the ability to run code that interacts with the Connected User Experiences and Telemetry (DiagTrack) service, which is present and running by default on the affected Windows 10/11 and Server 2016-2025 builds. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so the main limiting factor is simply obtaining that initial low-privileged local access; on systems where the DiagTrack service has been disabled the attack surface is removed.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 (High) and is internally consistent with the description: local attack vector, low complexity, low privileges already required, no user interaction, and full high impact to confidentiality, integrity, and availability - the classic profile of an authenticated-user-to-SYSTEM elevation. There is no EPSS score, no SSVC decision data, and no KEV listing provided, so exploitation-probability signals are absent rather than low; the practical priority rests on the CVSS profile plus the ubiquity of the affected component. Because the bug requires an attacker to already have code execution as a normal user on the box (PR:L, AV:L), it is not a remote entry point but a powerful second-stage/post-compromise primitive typically chained after initial access. No POC has been reported and it is not known to be actively exploited, so this is a real but non-emergency 'patch on normal cadence, prioritize on high-value or multi-user hosts' issue rather than a drop-everything remote-exploitation event.

An attacker who has already gained a foothold as a standard user - for example through phishing, a compromised application, or stolen credentials - runs a crafted program locally that interacts with the Connected User Experiences and Telemetry service to trigger the type-confusion condition. By controlling the mis-typed object, they corrupt the privileged service's memory to execute code as SYSTEM, escalating from a limited account to full control of the host. No user interaction and only low privileges are required, though no public exploit code has been identified at time of analysis.