Skip to main content

Severity by source

Vendor (microsoft) PRIMARY
HIGH
qualitative
NVD
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CIRCL (temporal)
6.1 MEDIUM
cvss
vuln.today AI
8.1 HIGH

Network-reachable with no auth or interaction (AV:N/PR:N/UI:N), but winning the race is non-deterministic so AC:H; successful EoP yields total impact (C:H/I:H/A:H), scope unchanged.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Updated
Jul 21, 2026 - 16:45 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 21, 2026 - 16:37 vuln.today
cvss_changed
CVSS changed
Jul 21, 2026 - 16:37 NVD
7.0 (HIGH) 8.1 (HIGH)
Analysis Generated
Jul 14, 2026 - 20:21 vuln.today
CVE Published
Jul 14, 2026 - 17:06 nvd
HIGH 7.0

DescriptionNVD

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Elevation of privilege in the Windows Runtime (WinRT) component of Microsoft Windows and Windows Server allows an unauthorized network attacker to win a race condition and gain elevated privileges, achieving full compromise of confidentiality, integrity, and availability. The flaw affects a broad range of supported builds - Windows 10 (1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2019/2022/2025 - and Microsoft has shipped patches. There is no public exploit identified at time of analysis and CISA/SSVC records no known exploitation, though the low CVSS attack complexity of winning the race is offset by the high technical impact.

Technical ContextAI

The vulnerability is classified as CWE-362 (concurrent execution using a shared resource with improper synchronization, i.e. a race condition) in the Windows Runtime (WinRT), the object-based application-programming layer that underpins modern Windows APIs and is present across all supported client and server SKUs. Because WinRT brokers requests among components with differing privilege levels, a Time-of-Check-to-Time-of-Use style window in its handling of a shared resource can let an attacker manipulate state between validation and use. The CPE set (cpe:2.3:a:microsoft:windows_10_version_1809 through windows_server_2025, including Server Core installations) confirms this is a core-OS defect rather than an optional feature, meaning virtually every default installation ships the affected code path.

RemediationAI

Apply Microsoft's security updates via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50452 (Vendor-released patch: install builds at or above the fixed versions - Windows 10 1809/Server 2019 10.0.17763.9020, Windows 10 21H2 10.0.19044.7548, Windows 10 22H2 10.0.19045.7548, Windows 11 24H2 10.0.26100.8875, Windows 11 25H2 10.0.26200.8875, Windows 11 26H1 10.0.28000.2269, Windows Server 2022 10.0.20348.5386, and Windows Server 2025 10.0.26100.33158). Prioritize patching internet-facing and high-value systems first because the vector is network-reachable. No vendor workaround is published; as compensating controls until patching, restrict network reachability to WinRT/RPC-based management surfaces by firewalling SMB/RPC (TCP 135/445) and dynamic RPC ports at network boundaries and enforcing host-based segmentation, accepting that this can break legitimate remote-management and inter-service traffic - validate in a staging environment before broad rollout. Also see the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-50452.

CVE-2026-33824 CRITICAL POC
9.8 Apr 14

Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen

CVE-2026-56155 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p

CVE-2026-32202 MEDIUM POC
4.3 Apr 14

Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n

CVE-2026-49798 CRITICAL POC
9.3 Jul 14

Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve

CVE-2026-49795 HIGH POC
8.8 Jul 14

Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-

CVE-2026-54128 HIGH POC
8.4 Jul 14

Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff

CVE-2026-50518 CRITICAL
9.8 Jul 14

Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr

CVE-2026-50655 HIGH POC
7.8 Jul 14

Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug

CVE-2026-54992 HIGH POC
7.8 Jul 14

Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component

CVE-2026-50489 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem

CVE-2026-50667 HIGH POC
7.0 Jul 14

Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c

CVE-2026-57092 CRITICAL
9.9 Jul 14

Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating

Share

CVE-2026-50452 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy