What is the CVSS score of CVE-2026-50667?

CVE-2026-50667 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.2%.

Which versions of Windows NTFS are affected by CVE-2026-50667?

A local privilege escalation vulnerability in the Windows NTFS file system driver (CVE-2026-50667) affects Windows 10, 11, and Server 2012-2025, potentially allowing authenticated low-privileged…. A patch is available.

Is there a public PoC exploit available for CVE-2026-50667?

Yes, a public proof-of-concept exploit is available for CVE-2026-50667. Prioritise patching immediately. EPSS: 2.2%.

How to fix or mitigate CVE-2026-50667?

Within 24 hours: Audit all Windows 10 (version 1607 and later), Windows 11, and Windows Server 2012 through 2025 systems in your enterprise environment to identify patch status. Within 7 days: Begin deploying Microsoft's latest security patch available through Windows Update and WSUS to high-risk systems including domain controllers, multi-user servers, and internet-facing infrastructure, while validating compatibility in a staging environment. Within 30 days: Complete patching of all remaining Windows client and server systems across the enterprise, and review local security policies to restrict unnecessary local user access on critical infrastructure as a compensating control for any systems requiring extended patching windows.

Windows NTFS CVE-2026-50667

EUVD-2026-44124 HIGH

Race Condition (CWE-362)

2026-07-14 microsoft

GHSA-jp4g-rx9m-6v4h

Information Disclosure Race Condition Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.0

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local-only race requiring an existing low-priv account gives AV:L/AC:H/PR:L; a successful SYSTEM-level win yields total C/I/A with unchanged scope.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 15:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 15:07 vuln.today

cvss_changed

CVSS changed

Jul 22, 2026 - 15:07 NVD

7.8 (HIGH) 7.0 (HIGH)

Analysis Generated

Jul 14, 2026 - 19:48 vuln.today

CVE Published

Jul 14, 2026 - 17:08 nvd

HIGH 7.8

DescriptionNVD

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race condition (CWE-362) to gain SYSTEM-level rights across nearly all supported Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has shipped fixes and publicly available exploit code exists, though EPSS rates near-term mass exploitation modestly at 2.16% (80th percentile) and CISA's SSVC framework records no observed exploitation, indicating opportunistic rather than widespread abuse. The high AC:H reflects the timing-dependent nature of the flaw, which reduces reliability but does not eliminate risk on multi-user or shared hosts.

Technical ContextAI

The vulnerability lives in NTFS, the default on-disk file system driver (ntfs.sys) that underpins virtually every Windows installation and mediates all local file and metadata operations. The root cause is CWE-362, concurrent execution using a shared resource with improper synchronization - a race condition in which two threads operating on shared NTFS state are not correctly serialized, creating a time-of-check to time-of-use style window an attacker can exploit to corrupt or reuse kernel-managed resources. The affected CPE set (cpe:2.3:a:microsoft:windows_10_version_1607 through windows_11_version_26h1, plus windows_server_2012 and later) confirms the defect resides in the shared kernel-mode NTFS code common to both client and server SKUs, so any host that mounts an NTFS volume - effectively all of them - carries the vulnerable component.

RemediationAI

Apply the Microsoft security update for your specific build as the primary and complete fix - Vendor-released patch: install at minimum 10.0.14393.9339 (1607/Server 2016), 10.0.17763.9020 (1809/Server 2019), 10.0.19044.7548 (21H2), 10.0.19045.7548 (22H2), 10.0.26100.8875 (24H2)/10.0.26200.8875 (25H2), 10.0.28000.2525 (26H1), 10.0.20348.5386 (Server 2022), 10.0.26100.33158 (Server 2025), 6.2.9200.26226 (Server 2012), or 6.3.9600.23291 (Server 2012 R2), sourced from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50667. Microsoft provides no dedicated pre-patch workaround for a kernel driver race, so where patching must be deferred the practical compensating controls are to restrict who can execute code on the host: remove untrusted or standard interactive accounts from shared and terminal-server systems, enforce least privilege and application allow-listing (e.g. WDAC/AppLocker) to block delivery of exploit binaries, and prioritize multi-user hosts first - the trade-off is that these controls only reduce the pool of potential attackers and do not close the underlying race, so patching remains mandatory.