What is the CVSS score of CVE-2026-50669?

CVE-2026-50669 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows Telephony Service are affected by CVE-2026-50669?

Windows Telephony Service (TAPI) contains a privilege escalation flaw affecting Windows client and server systems (versions 10/11 and Server 2012-2025), allowing local attackers to achieve full…. A patch is available.

How to fix or mitigate CVE-2026-50669?

Within 24 hours: Inventory all Windows 10, Windows 11, and Windows Server 2012-2025 systems in the infrastructure and assess which have local access controls and identify systems connected to potentially untrusted networks. Within 7 days: Develop and test a patching strategy prioritizing server infrastructure and systems with higher risk profiles; coordinate with Microsoft to obtain and validate the latest TAPI patch version for your environment. Within 30 days: Complete deployment of the vendor-released patch across all affected systems, prioritizing critical servers and client workstations with elevated privileges, and validate patch application through automated compliance scanning.

Windows Telephony Service CVE-2026-50669

EUVD-2026-44126 HIGH

Race Condition (CWE-362)

2026-07-14 microsoft

GHSA-fx47-xcfr-9fc8

Information Disclosure Race Condition Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local foothold with low privileges (AV:L/PR:L), race-condition timing makes it high-complexity (AC:H), and successful escalation yields full SYSTEM control (C:H/I:H/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:46 vuln.today

CVE Published

Jul 14, 2026 - 17:08 nvd

HIGH 7.0

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Telephony Service (TAPI) affects a broad range of Microsoft Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. A local, low-privileged attacker who wins a race condition (CWE-362) in the service's handling of a shared resource can corrupt state and elevate to higher privileges, gaining full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS was not provided.

Technical ContextAI

The Windows Telephony Service (TAPISRV) is a long-standing OS component that brokers telephony/TAPI requests between user applications and device drivers, and it runs as a privileged service. The root cause is CWE-362, 'Concurrent Execution Using Shared Resource with Improper Synchronization (Race Condition)': multiple threads access a shared object without adequate locking, so an attacker who interleaves requests at the right moment can reach an inconsistent or time-of-check-to-time-of-use state. The CPE set (cpe:2.3:a:microsoft:windows_10_version_1607 through windows_11_version_26h1, plus windows_server_2012, 2012_r2 and their Server Core installations) indicates the flawed service ships across essentially the entire supported Windows codebase, consistent with a component maintained in the core OS rather than an add-on.

RemediationAI

Apply the Microsoft security update for CVE-2026-50669 for your specific build; Patch available per vendor advisory, with exact fixed KB/build numbers listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50669 (no single global fix version was provided in the input, so consult the advisory for your OS release). Because this is a local elevation-of-privilege bug in a privileged service, the most effective compensating control until patching is to reduce local footholds: restrict interactive and low-privilege local logon on servers, enforce least privilege so untrusted code cannot run locally, and monitor for anomalous manipulation of the Telephony service. If TAPI/telephony functionality is not required, disabling or restricting the Telephony service (TapiSrv) can remove the attack surface, but this will break any application or RAS/dial-up component that depends on TAPI, so test before deploying. Prioritize patching on multi-user, RDS/Citrix, and shared-workstation hosts where untrusted users have local sessions.