Microsoft Windows CVE-2026-50480

Exploitation requires the attacker to already possess valid low-privileged local access to the target host (CVSS PR:L, AV:L) and the ability to reach and trigger the Windows WPAD / auto-proxy-discovery code path; no user interaction is needed (UI:N). The specific feature involved is the Web Proxy Auto-Discovery Protocol handling on the affected SKUs (Windows 10 1607; Windows Server 2012, 2012 R2, 2016, incl. Server Core). Limiting factors: this is NOT remotely exploitable without a prior foothold, cannot be launched by a fully unauthenticated network attacker, and is constrained to the enumerated legacy Windows versions; environments that have disabled WPAD/auto-proxy discovery further reduce the reachable attack surface. Whether a non-default configuration is required to reach the vulnerable path is not specified in the provided data and should be verified against the Microsoft advisory.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable, low-complexity elevation of privilege requiring an attacker to already hold low-privileged access on the host, with no user interaction and full confidentiality, integrity, and availability impact once triggered. This is a classic second-stage / post-compromise EoP primitive rather than an initial-access, wormable network flaw - the local attack vector meaningfully caps mass-exploitation potential. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified from the data; the absence of KEV and POC signals suggests no confirmed active exploitation at this time. The signals are internally consistent (Microsoft-reported, patch available, local EoP), with no contradictions between the vector and the description. Realistic priority is moderate-to-high for multi-user hosts, terminal/RDP servers, and domain controllers running the affected legacy Server SKUs, where an attacker chaining an initial foothold to SYSTEM is the primary concern; single-user endpoints where the attacker already has admin gain less.

An attacker who has already gained a low-privileged foothold on an affected Windows Server 2016 or Server 2012 R2 host - for example via phishing, a compromised service account, or stolen credentials - triggers the WPAD component to process crafted proxy-discovery data, overflowing a heap buffer. By grooming the heap and corrupting adjacent structures, they hijack execution in the higher-privileged service context to escalate toward SYSTEM. No public POC is identified in the provided data, and the local, low-complexity nature means a working exploit would run reliably once developed.