What is the CVSS score of CVE-2026-55014?

CVE-2026-55014 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows Remote Help are affected by CVE-2026-55014?

Microsoft Windows Remote Help, a tool used for IT support operations, contains a vulnerability allowing authenticated users with basic system access to gain full administrative privileges without…. A patch is available.

How to fix or mitigate CVE-2026-55014?

Within 24 hours, identify and inventory all Windows systems with Remote Help installed, prioritizing systems handling sensitive data or running critical business operations. Within 7 days, deploy the Microsoft security patch for CVE-2026-55014 to all affected systems, beginning with high-priority assets; verify deployment through your endpoint management console and review Windows Update logs. Within 30 days, confirm patch compliance across the entire environment via vulnerability scanning, remediate any remaining unpatched systems, and review access controls to ensure Remote Help is restricted to authorized personnel only.

Windows Remote Help CVE-2026-55014

EUVD-2026-43763 HIGH

Improper Access Control (CWE-284)

2026-07-14 microsoft

GHSA-3x6v-8qxw-j8h4

Authentication Bypass Microsoft Windows Remote Help

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today AI

7.8 HIGH

Attacker needs an existing low-privileged local session (AV:L, PR:L), no interaction (UI:N), and gains full-privilege control yielding high C/I/A with unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 17:56 vuln.today

CVE Published

Jul 14, 2026 - 17:05 nvd

HIGH 7.8

DescriptionCVE.org

Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows Remote Help allows an authenticated low-privileged user to elevate to higher privileges via improper access control (authorization bypass) in the Remote Help component. Exploitation requires prior local access with limited privileges (PR:L) but no user interaction, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though Microsoft has released a patch.

Technical ContextAI

Windows Remote Help is Microsoft's cloud-connected remote assistance tool (successor to Quick Assist, typically deployed via Microsoft Intune) that lets helpdesk staff securely view and control managed endpoints. The flaw is classified as CWE-284 (Improper Access Control), meaning the application fails to correctly enforce authorization boundaries - an access-control decision that should restrict privileged operations to trusted principals is missing or wrongly evaluated. The affected component is identified by CPE cpe:2.3:a:microsoft:windows_remote_help across all listed versions, and the vendor tags characterize the root cause as an Authentication Bypass permitting a lower-privileged local user to perform actions reserved for a higher trust level.

RemediationAI

Apply the Microsoft-released update for CVE-2026-55014 as documented in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55014); patch availability is confirmed by the vendor, though the input does not enumerate the exact fixed version, so pull the specific build from that advisory and, because Remote Help is typically distributed through Microsoft Intune / the Microsoft Store for Business, ensure the deployed app package is updated to the patched release across managed endpoints. As a compensating control until patching completes, restrict which users can install and run Remote Help by tightening Intune app-assignment and app-protection policies, and consider temporarily disabling or unassigning Remote Help on high-value hosts - the trade-off is loss of remote helpdesk capability on those devices. Because the attack is local and requires an existing low-privileged session, also enforce least-privilege on interactive logon rights and monitor endpoints for unexpected privilege elevation, accepting that this only reduces rather than eliminates exposure.