EUVD-2026-43818
GHSA-7gfp-mj38-9w3p
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation by an authenticated low-privilege user (AV:L, PR:L), no interaction and low complexity, yielding full SYSTEM control (C/I/A:H) without scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper access control in Windows Server allows an authorized attacker to elevate privileges locally.
AnalysisAI
Elevation of privilege in Microsoft Windows (Server 2012 through 2025 and Windows 10/11 clients) lets a low-privileged local user gain SYSTEM-level rights by abusing an improper access control (CWE-284) weakness. The flaw was reported by Microsoft with a patch available, and CVSS 3.1 rates it 7.8 (High) with local vector and low privileges required. No public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-worthy but not emergency issue absent evidence of active exploitation.
Technical ContextAI
The root cause is CWE-284 (Improper Access Control), meaning a Windows component fails to correctly enforce authorization boundaries, allowing an already-authenticated local principal to perform actions reserved for a higher privilege level. CPE data confirms the weakness spans a broad family of Windows kernel/OS builds: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 including Server Core installations. Because the affected surface is a core OS component present across both client and server SKUs, the underlying defective access check is likely in a shared Windows subsystem rather than a server-only role. Microsoft tags it as an Authentication Bypass, consistent with an authorization/access-control failure that lets a lower-trust context cross into a higher-trust one.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-50311 published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50311, selecting the correct cumulative/monthly rollup for each affected SKU (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2012 through 2025 including Server Core). The input does not include exact fixed build numbers, so pull the precise KB/build from the MSRC per-product update table before deploying. No vendor-provided workaround is listed; as compensating controls until patching, restrict interactive and local logon rights to reduce the pool of unprivileged local accounts that could abuse the flaw, enforce least privilege and application allow-listing to hinder an attacker from running escalation tooling, and prioritize multi-user and internet-exposed hosts (RDP/terminal servers, jump boxes) where untrusted local sessions are most likely - noting these controls reduce but do not eliminate exposure since any authorized local user remains a potential vector.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today