What is the CVSS score of CVE-2026-50459?

CVE-2026-50459 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Windows Kernel are affected by CVE-2026-50459?

A Windows Kernel privilege escalation flaw (CVE-2026-50459) affects Windows 10, 11, and Server systems, allowing authenticated users to elevate to SYSTEM privileges and potentially compromise…. A patch is available.

How to fix or mitigate CVE-2026-50459?

Within 24 hours, use your asset inventory tools to identify all Windows 10, Windows 11, and Windows Server systems across your environment and confirm patch deployment capability through your update management infrastructure (SCCM/WSUS). Within 7 days, obtain the vendor patch from the MSRC security update guide, test it in your non-production environment to validate stability and compatibility with line-of-business applications, and develop a staged deployment plan. Within 30 days, complete patch deployment to all production Windows endpoints and servers, prioritizing systems running administrative accounts and high-privilege services where SYSTEM-level access poses the greatest business risk.

Windows Kernel CVE-2026-50459

EUVD-2026-44085 HIGH

Use After Free (CWE-416)

2026-07-14 microsoft

GHSA-pfwp-6ww7-h9wr

Denial Of Service Use After Free Memory Corruption Microsoft Windows Server 2022 Windows Server 2025 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation

7.8

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local kernel EoP from a low-privileged foothold with no user interaction; use-after-free yields SYSTEM, giving full confidentiality, integrity, and availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 21, 2026 - 15:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 21, 2026 - 15:07 vuln.today

cvss_changed

CVSS changed

Jul 21, 2026 - 15:07 NVD

7.0 (HIGH) 7.8 (HIGH)

Analysis Generated

Jul 14, 2026 - 20:17 vuln.today

CVE Published

Jul 14, 2026 - 17:07 nvd

HIGH 7.0

DescriptionNVD

Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Microsoft Windows Kernel lets an authenticated low-privileged user exploit a use-after-free (CWE-416) memory corruption flaw to elevate to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server builds. Reported by Microsoft and rated CVSS 7.8, it is not currently in CISA KEV and has no public exploit identified at time of analysis; the EPSS score is low at 0.26% (17th percentile). A vendor patch is available via the MSRC update guide.

Technical ContextAI

The defect resides in the Windows Kernel (the core ntoskrnl/kernel-mode execution layer that manages memory, scheduling, and object handling for the entire OS). CWE-416 Use After Free means kernel code continues to reference a memory object after it has been freed, so an attacker who can influence allocation/free timing and re-occupy the freed slot can corrupt kernel memory and hijack execution flow. Because the kernel runs at the highest privilege ring, a successful UAF exploit typically yields arbitrary code execution or a controlled write in kernel context, translating directly to SYSTEM-level privileges. The CPE set spans Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2022/2025 (including Server Core), indicating the vulnerable code path is present in the shared modern Windows kernel base rather than a single edition-specific component.

RemediationAI

Apply the Microsoft security update that raises each affected edition to its fixed build or later: Windows 10 21H2 to 10.0.19044.7548, Windows 10 22H2 to 10.0.19045.7548, Windows 11 24H2 to 10.0.26100.8875, Windows 11 25H2 to 10.0.26200.8875, Windows 11 26H1 to 10.0.28000.2269, Windows Server 2022 to 10.0.20348.5386, and Windows Server 2025 (including Server Core) to 10.0.26100.33158, all obtained via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50459. Because exploitation requires a local low-privileged foothold, the most effective compensating control until patching is to minimize who can run code as a standard user on the host: restrict interactive and remote-desktop logon rights on shared or multi-user systems, remove unnecessary local accounts, and enforce application allowlisting (e.g., WDAC/AppLocker) to make it harder for an attacker to land the initial user-context code needed to trigger the kernel UAF - noting that allowlisting adds administrative overhead and can block legitimate tooling. There is no network-facing setting to disable, so patching remains the definitive fix.