Windows Event Logging Service CVE-2026-50502

Exploitation requires the attacker to already hold valid low-privilege authentication on the network (CVSS PR:L), and network reachability to the Windows Event Logging Service's remote interface (AV:N). No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors that reduce realistic risk: the attacker must possess working credentials rather than being fully unauthenticated, the SSVC assessment rates the attack as not automatable (so it is not suited to indiscriminate mass exploitation), and access to the remote event-log RPC endpoint must not be firewalled off from the attacker. The affected feature is the OS-level Event Logging Service present across the listed Windows client and Server builds, so no non-default configuration is needed beyond the service being reachable.

The signals point to a serious but not emergency-tier issue. The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - network reachable, low attack complexity, no user interaction, but requiring low-level authentication (PR:L). The SSVC framework reports Exploitation: none (no observed or public exploitation), Automatable: no (an attacker cannot reliably automate mass exploitation, consistent with the PR:L requirement for valid credentials), and Technical Impact: total, matching the C:H/I:H/A:H rating. EPSS is low at 0.61% (45th percentile), and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation. The combination - high impact but requiring authentication and not automatable, with low EPSS and no KEV listing - suggests a genuine patch priority for domain and server environments (because a foothold account could pivot to code execution across the fleet) but not a drop-everything zero-day. No major conflicts exist in the data: the PR:L requirement is consistent with SSVC 'Automatable: no,' and the low EPSS aligns with SSVC 'Exploitation: none.'

An attacker who has obtained a low-privileged but valid account on the network sends crafted requests to the Windows Event Logging Service over its remote RPC interface, abusing the service's overly coarse access controls to invoke privileged operations and execute arbitrary code on the target host. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, no victim interaction is needed and the technical steps are low-complexity, though the attacker must first hold credentials. No public proof-of-concept exploit has been identified at time of analysis.