EUVD-2026-43821
GHSA-42jq-q72w-7j5j
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation requiring an existing low-privileged session (AV:L, PR:L), no user interaction and low complexity (UI:N, AC:L), yielding full SYSTEM compromise (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Spaceport.sys Storage Spaces driver lets an already-authenticated low-privileged user gain SYSTEM-level control across Windows 10, Windows 11, and Windows Server 2016 through 2025. The flaw stems from a missing authentication check on a critical driver function (CWE-306), and Microsoft has released a patch; no public exploit has been identified at time of analysis. With CVSS 7.8 (local, low-privilege) and full confidentiality, integrity, and availability impact, it is a strong candidate for chaining after an initial foothold.
Technical ContextAI
Spaceport.sys is the kernel-mode driver that implements Windows Storage Spaces, the storage virtualization subsystem that pools physical disks into resilient virtual volumes. The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function), meaning a privileged operation exposed by the driver can be invoked without the caller proving it holds the required authorization. Because Spaceport.sys runs in kernel context, a successful invocation of that unprotected function executes with the driver's privileges, allowing a normal user process to reach functionality that should be gated behind higher trust. The CPE data confirms this affects the OS component itself across the full supported Windows client and server line rather than a standalone application.
RemediationAI
Patch available per vendor advisory: apply Microsoft's security update for CVE-2026-50333 from the MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50333, selecting the correct cumulative update for each affected Windows 10, Windows 11, and Windows Server build; the exact patched version numbers should be taken from that advisory rather than assumed. As this ships through the standard monthly cumulative update channel, prioritize deployment on multi-user and remotely accessible hosts (RDP servers, shared workstations) first. If patching must be delayed, reduce exposure by minimizing the number of low-privileged interactive/local accounts on affected systems and tightening who can obtain local logon sessions, since exploitation requires an existing local user context; this compensating control limits legitimate multi-user access and does not remove the underlying flaw. Storage Spaces cannot be safely disabled as a workaround on systems that rely on it for their disk volumes, so patching is the reliable fix.
More in Windows Server 2016
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today