What is the CVSS score of CVE-2026-50504?

CVE-2026-50504 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Which versions of Windows Server 2012 are affected by CVE-2026-50504?

A remote information disclosure vulnerability in Windows Remote Desktop Client (CVE-2026-50504) affects Windows Server 2012 through Windows Server 2025 and Windows 11, enabling attackers to leak…. A patch is available.

How to fix or mitigate CVE-2026-50504?

Within 24 hours, inventory all systems running affected Windows versions (Server 2012-2025, Windows 11 26H1 and earlier) and identify which are directly internet-facing or receive untrusted RDP connections; flag systems with sensitive data handling as critical priority. Within 7 days, deploy the Microsoft patch to all internet-exposed and critical-tier systems, beginning with domain controllers, bastion hosts, and administrative access points; verify patch application with WSUS or similar tools. Within 30 days, complete patch deployment across all remaining affected systems in the estate, document remediation status, and validate that legacy RDP clients are updated from Microsoft's security advisory.

Windows Server 2012 CVE-2026-50504

EUVD-2026-44113 HIGH

Buffer Over-read (CWE-126)

2026-07-14 microsoft

GHSA-v8qc-849m-xjwc

Buffer Overflow Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

MEDIUM

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 16:46 vuln.today

Severity Changed

Jul 22, 2026 - 15:07 NVD

MEDIUM HIGH

CVSS changed

Jul 22, 2026 - 15:07 NVD

6.5 (MEDIUM) 7.5 (HIGH)

CVE Published

Jul 14, 2026 - 17:08 nvd

HIGH 7.5

CVE Published

Jul 14, 2026 - 17:08 cve.org

MEDIUM 6.5

DescriptionNVD

Buffer over-read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Information disclosure in the Windows Remote Desktop Client (mstsc/RDP client component) lets a remote attacker read memory beyond an intended buffer boundary, leaking potentially sensitive process data over the network. The flaw affects a broad span of supported Windows client and server releases from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. There is no public exploit identified at time of analysis, EPSS risk is modest (0.64%), and CISA's SSVC framework marks exploitation as 'none' — a patch is available from Microsoft.