EUVD-2026-44074
GHSA-rvgx-9f8h-xpr7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable WSUS function with low complexity and no UI; PR:L reflects the required low-privilege foothold, and missing auth on a critical role yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Missing authentication for critical function in Windows Server Update Service allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in Microsoft's Windows Server Update Services (WSUS) role allows a network-based, low-privileged attacker to gain higher privileges due to a missing authentication check on a critical function (CWE-306). The flaw affects WSUS as shipped on Windows Server 2012 through 2025 (and client builds Windows 10 1607/1809), with a CVSS 3.1 base score of 8.8; Microsoft has released a patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, low-complexity nature makes this a high-priority patch for update-management infrastructure.
Technical ContextAI
WSUS is the on-premises Microsoft update-distribution role that enterprises use to approve and deploy Windows/Microsoft patches to managed endpoints, typically exposing HTTP/HTTPS services (default ports 8530/8531) to the internal network. The root cause is CWE-306 (Missing Authentication for a Critical Function): a privileged WSUS operation is exposed without properly verifying the caller's authorization, so an already-authenticated but low-privileged network principal can invoke functionality reserved for higher-privileged roles. Because WSUS is a trusted software-distribution channel, weaknesses in its authorization model are attractive: the CPE set (cpe:2.3:a:microsoft:windows_server_2012 through windows_server_2019, plus Windows 10 1607/1809, with tags extending to Server 2022/2025) indicates the vulnerable code ships across the full modern Windows Server line where the WSUS role can be installed.
RemediationAI
Apply the Microsoft security update for CVE-2026-50444 to every affected system running the WSUS role; a patch is available per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50444, where the exact fixed build for each OS (Server 2012 through 2025, plus Windows 10 1607/1809) is listed - install the KB matching your specific OS version and cumulative-update baseline. Because the source data provides no standalone fixed version string, treat the MSRC page as the authoritative source for the precise build and prioritize deployment on internet-adjacent or widely-trusted WSUS servers first. As compensating controls until patched, restrict network access to the WSUS ports (8530/8531 by default) to only the client subnets and admin hosts that must reach the server via host firewall or network ACLs, and enforce HTTPS/TLS on the WSUS endpoint; note the trade-off that overly tight ACLs can break update delivery to legitimate clients, so scope allow-lists to known management ranges. Monitor WSUS server logs and authentication events for anomalous privileged operations as an interim detection measure.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today