EUVD-2026-44069
GHSA-mx3q-8ph8-rf8h
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local EoP by an authenticated low-priv user (AV:L, PR:L) with no interaction; link-following yields SYSTEM-level file control, hence S:C and C/I/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft PC Manager lets an already-authenticated low-privileged user abuse improper symbolic/hard link resolution (CWE-59) to gain higher privileges, likely SYSTEM given the CVSS scope change. Rated CVSS 8.8, the flaw carries high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available via MSRC.
Technical ContextAI
Microsoft PC Manager is Microsoft's consumer-oriented Windows optimization and cleanup utility (CPE cpe:2.3:a:microsoft:microsoft_pc_manager). The root cause is a CWE-59 'link following' weakness: a privileged component of the application (typically a background service or scheduled cleanup routine running as SYSTEM) accesses a filesystem path without first validating whether that path is a symbolic link, hard link, junction, or reparse point. A low-privileged user who controls a location the privileged process reads from or writes to can plant a link redirecting the operation to an arbitrary protected file, causing the privileged process to read, overwrite, or create files outside its intended scope - a classic Windows local elevation-of-privilege primitive.
RemediationAI
Patch available per vendor advisory: update Microsoft PC Manager to the fixed release referenced in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50438); the exact patched build is not specified in the provided data and should be confirmed there. Because PC Manager typically auto-updates, ensure automatic updates are enabled and force an update check. If patching cannot be completed immediately, the most effective compensating control is to uninstall PC Manager where it is not needed, since it is an optional utility with no core OS dependency - a low-side-effect mitigation. Alternatively, restrict which users can log in interactively to affected hosts and remove unnecessary local accounts, since exploitation requires a local low-privileged session; this reduces exposure but does not address the underlying link-following flaw.
More in Microsoft Pc Manager
View allLocal privilege escalation in Microsoft PC Manager allows an authenticated low-privileged user to gain elevated (typical
Local privilege escalation in Microsoft PC Manager allows an authenticated low-privileged user on Windows to gain higher
Local privilege escalation in Microsoft PC Manager allows an authenticated low-privileged attacker to gain elevated righ
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today