What is the CVSS score of CVE-2026-50504?

CVE-2026-50504 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Windows Server 2012 CVE-2026-50504

Q: Which versions of Windows Server 2012 are affected by CVE-2026-50504?

A remote information disclosure vulnerability in Windows Remote Desktop Client (CVE-2026-50504) affects Windows Server 2012 through Windows Server 2025 and Windows 11, enabling attackers to leak…. A patch is available.

Q: How to fix or mitigate CVE-2026-50504?

Within 24 hours, inventory all systems running affected Windows versions (Server 2012-2025, Windows 11 26H1 and earlier) and identify which are directly internet-facing or receive untrusted RDP connections; flag systems with sensitive data handling as critical priority. Within 7 days, deploy the Microsoft patch to all internet-exposed and critical-tier systems, beginning with domain controllers, bastion hosts, and administrative access points; verify patch application with WSUS or similar tools. Within 30 days, complete patch deployment across all remaining affected systems in the estate, document remediation status, and validate that legacy RDP clients are updated from Microsoft's security advisory.

EUVD-2026-44113 HIGH

Buffer Over-read (CWE-126)

2026-07-14 microsoft

GHSA-v8qc-849m-xjwc

Buffer Overflow Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.5

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness

CWE

CWE-126

ASVS 5.0

V15 - Secure Coding and Architecture Buffer over-read prevention

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Information disclosure in the Windows Remote Desktop Client (mstsc/RDP client component) lets a remote attacker read memory beyond an intended buffer boundary, leaking potentially sensitive process data over the network. The flaw affects a broad span of supported Windows client and server releases from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. There is no public exploit identified at time of analysis, EPSS risk is modest (0.64%), and CISA's SSVC framework marks exploitation as 'none' — a patch is available from Microsoft.

Affected VersionsENISA

Windows Server 2012 R2 (Server Core installation) 6.3.9600.0 <6.3.9600.23291

Windows Server 2012 6.2.9200.0 <6.2.9200.26226

Windows 11 version 26H1 10.0.28000.0 <10.0.28000.2269

Windows 11 Version 24H2 10.0.26100.0 <10.0.26100.8875

Windows Server 2025 (Server Core installation) 10.0.26100.0 <10.0.26100.33158

Windows Server 2016 10.0.14393.0 <10.0.14393.9339

Windows 10 Version 1809 10.0.17763.0 <10.0.17763.9020

Windows Server 2012 R2 6.3.9600.0 <6.3.9600.23291

Windows Server 2022 10.0.20348.0 <10.0.20348.5386

Windows 11 Version 25H2 10.0.26200.0 <10.0.26200.8875

Windows 10 Version 21H2 10.0.19044.0 <10.0.19044.7548

Windows Server 2019 (Server Core installation) 10.0.17763.0 <10.0.17763.9020

Windows 10 Version 22H2 10.0.19045.0 <10.0.19045.7548

Windows Server 2016 (Server Core installation) 10.0.14393.0 <10.0.14393.9339

Windows 10 Version 1607 10.0.14393.0 <10.0.14393.9339

Windows Server 2025 10.0.26100.0 <10.0.26100.33158

Windows Server 2019 10.0.17763.0 <10.0.17763.9020

Windows Server 2012 (Server Core installation) 6.2.9200.0 <6.2.9200.26226

Affected Packages

euvd windows_10_version_1607 fix: 10.0.14393.9339

euvd windows_10_version_1809 fix: 10.0.17763.9020

euvd windows_10_version_21h2 fix: 10.0.19044.7548

euvd windows_10_version_22h2 fix: 10.0.19045.7548

euvd windows_11_version_24h2 fix: 10.0.26100.8875

euvd windows_11_version_25h2 fix: 10.0.26200.8875

euvd windows_11_version_26h1 fix: 10.0.28000.2269

euvd windows_server_2012 fix: 6.2.9200.26226

euvd windows_server_2012_r2 fix: 6.3.9600.23291

euvd windows_server_2012_r2_server_core_installation fix: 6.3.9600.23291

euvd windows_server_2012_server_core_installation fix: 6.2.9200.26226

euvd windows_server_2016 fix: 10.0.14393.9339

euvd windows_server_2016_server_core_installation fix: 10.0.14393.9339

euvd windows_server_2019 fix: 10.0.17763.9020

euvd windows_server_2019_server_core_installation fix: 10.0.17763.9020

euvd windows_server_2022 fix: 10.0.20348.5386

euvd windows_server_2025 fix: 10.0.26100.33158

euvd windows_server_2025_server_core_installation fix: 10.0.26100.33158

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 18 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Windows Server 2012 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY MEDIUM

NVD 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Jul 22, 2026 - 15:07 NVD

MEDIUM HIGH

CVSS changed

Jul 22, 2026 - 15:07 NVD

6.5 (MEDIUM) 7.5 (HIGH)

CVE Published

Jul 14, 2026 - 17:08 nvd

HIGH 7.5

CVE Published

Jul 14, 2026 - 17:08 cve.org

MEDIUM 6.5

DescriptionNVD

Buffer over-read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

Executive ViewAI

Why It Matters

A remote information disclosure vulnerability in Windows Remote Desktop Client (CVE-2026-50504) affects Windows Server 2012 through Windows Server 2025 and Windows 11, enabling attackers to leak sensitive process data via memory buffer overflow. With 0.6% EPSS risk and no public exploits currently identified, this poses moderate immediate risk but affects a critical administrative tool used across most enterprise networks. Microsoft has released a patch that organizations should prioritize to prevent potential data exfiltration and lateral movement.

Recommended Action

Within 24 hours, inventory all systems running affected Windows versions (Server 2012-2025, Windows 11 26H1 and earlier) and identify which are directly internet-facing or receive untrusted RDP connections; flag systems with sensitive data handling as critical priority. Within 7 days, deploy the Microsoft patch to all internet-exposed and critical-tier systems, beginning with domain controllers, bastion hosts, and administrative access points; verify patch application with WSUS or similar tools. Within 30 days, complete patch deployment across all remaining affected systems in the estate, document remediation status, and validate that legacy RDP clients are updated from Microsoft's security advisory.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.6%

Top 54% exploitable

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

5 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.6%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.