Windows Kernel CVE-2026-50423

The attacker must already possess local, low-privileged authenticated code-execution on the target host (PR:L, AV:L) - this is a post-compromise elevation, not a remote or unauthenticated vector, and cannot be triggered over the network. No specific non-default feature, protocol, or configuration setting is called out in the description, so default installations of the listed Windows 10, Windows 11, and Windows Server 2022/2025 builds are affected. Limiting factors are the local-access prerequisite and the need for the attacker to already hold at least a standard-user session; no user interaction is required once that access exists (UI:N).

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-reachable, low-complexity flaw needing only low privileges and no user interaction, yielding full confidentiality, integrity, and availability compromise - the classic profile of a SYSTEM privilege-escalation bug. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this is not a remotely-wormable issue and cannot be used for initial access. Realistically it is a second-stage tool: valuable to an attacker who already has a foothold, and historically Windows Kernel EoP bugs are frequently weaponized after disclosure, so it warrants prompt patching despite the absence of current exploitation signals. The absence of EPSS/KEV data means the low-exploitation-signal reading is based on missing data, not a confirmed low-risk determination.

An attacker who has already gained a foothold as a standard user - via phishing, a compromised service account, or an existing malware implant - executes a crafted program that abuses the kernel's improper access-control check to obtain a SYSTEM token. Given AV:L/AC:L, the exploit runs locally and reliably with no user interaction, letting the attacker disable security tooling, install persistence, and pivot. No public POC is currently identified, so this scenario reflects the vector rather than a known exploit.