What is the CVSS score of EUVD-2026-43913?

EUVD-2026-43913 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Windows Server 2012 EUVD-2026-43913

Q: Which versions of Windows Server 2012 are affected by EUVD-2026-43913?

Microsoft Windows LUAFV driver contains a privilege escalation flaw (CVSS 7.0) allowing authenticated low-privileged users to escalate to administrator/SYSTEM access on affected client and server…. A patch is available.

Q: How to fix or mitigate EUVD-2026-43913?

Within 24 hours, inventory all Windows client and server systems to identify affected versions and prioritize mission-critical systems. Within 7 days, download and test the Microsoft-released patch for CVE-2026-50371 on non-production systems to validate compatibility with business applications and infrastructure. Within 30 days, deploy the patch to all production Windows systems, prioritizing internet-facing servers and high-value internal systems.

| CVE-2026-50371 HIGH

Race Condition (CWE-362)

2026-07-14 microsoft

GHSA-q62c-86jc-v58p

Information Disclosure Race Condition Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.0

CVSS 3.1 · Vendor: microsoft

View

Vulnerability Assessment

Weakness

CWE

CWE-362

OWASP Top 10:2025

A06:2025 - Insecure Design

ASVS 5.0

V15 - Secure Coding and Architecture Concurrency control, locking

MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Local privilege escalation in Microsoft Windows via the LUAFV (LUA File Virtualization, luafv.sys) driver allows an already-authenticated low-privileged user to win a timing race and elevate to SYSTEM/administrator on affected Windows client and server builds. The flaw stems from improper synchronization around a shared resource (CWE-362) and carries a CVSS 7.0 (AV:L/AC:H/PR:L) reflecting a local, high-complexity attack. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has released a patch.

Affected VersionsENISA

Windows 11 Version 25H2 10.0.26200.0 <10.0.26200.8875

Windows Server 2012 (Server Core installation) 6.2.9200.0 <6.2.9200.26226

Windows Server 2025 (Server Core installation) 10.0.26100.0 <10.0.26100.33158

Windows 11 Version 24H2 10.0.26100.0 <10.0.26100.8875

Windows Server 2016 (Server Core installation) 10.0.14393.0 <10.0.14393.9339

Windows Server 2012 R2 6.3.9600.0 <6.3.9600.23291

Windows 10 Version 22H2 10.0.19045.0 <10.0.19045.7548

Windows Server 2019 10.0.17763.0 <10.0.17763.9020

Windows Server 2025 10.0.26100.0 <10.0.26100.33158

Windows Server 2019 (Server Core installation) 10.0.17763.0 <10.0.17763.9020

Windows Server 2012 6.2.9200.0 <6.2.9200.26226

Windows Server 2016 10.0.14393.0 <10.0.14393.9339

Windows Server 2012 R2 (Server Core installation) 6.3.9600.0 <6.3.9600.23291

Windows Server 2022 10.0.20348.0 <10.0.20348.5386

Windows 10 Version 1809 10.0.17763.0 <10.0.17763.9020

Windows 11 version 26H1 10.0.28000.0 <10.0.28000.2525

Windows 10 Version 1607 10.0.14393.0 <10.0.14393.9339

Windows 10 Version 21H2 10.0.19044.0 <10.0.19044.7548

Affected Packages

euvd windows_10_version_1607 fix: 10.0.14393.9339

euvd windows_10_version_1809 fix: 10.0.17763.9020

euvd windows_10_version_21h2 fix: 10.0.19044.7548

euvd windows_10_version_22h2 fix: 10.0.19045.7548

euvd windows_11_version_24h2 fix: 10.0.26100.8875

euvd windows_11_version_25h2 fix: 10.0.26200.8875

euvd windows_11_version_26h1 fix: 10.0.28000.2525

euvd windows_server_2012 fix: 6.2.9200.26226

euvd windows_server_2012_r2 fix: 6.3.9600.23291

euvd windows_server_2012_r2_server_core_installation fix: 6.3.9600.23291

euvd windows_server_2012_server_core_installation fix: 6.2.9200.26226

euvd windows_server_2016 fix: 10.0.14393.9339

euvd windows_server_2016_server_core_installation fix: 10.0.14393.9339

euvd windows_server_2019 fix: 10.0.17763.9020

euvd windows_server_2019_server_core_installation fix: 10.0.17763.9020

euvd windows_server_2022 fix: 10.0.20348.5386

euvd windows_server_2025 fix: 10.0.26100.33158

euvd windows_server_2025_server_core_installation fix: 10.0.26100.33158

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 18 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Windows Server 2012 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows LUAFV allows an authorized attacker to elevate privileges locally.

Executive ViewAI

Why It Matters

Microsoft Windows LUAFV driver contains a privilege escalation flaw (CVSS 7.0) allowing authenticated low-privileged users to escalate to administrator/SYSTEM access on affected client and server systems. This vulnerability enables insider threats and accounts compromised through phishing or malware to gain full system control, creating risk of data breach and lateral network compromise. Organizations running Windows require immediate patching.

Recommended Action

Within 24 hours, inventory all Windows client and server systems to identify affected versions and prioritize mission-critical systems. Within 7 days, download and test the Microsoft-released patch for CVE-2026-50371 on non-production systems to validate compatibility with business applications and infrastructure. Within 30 days, deploy the patch to all production Windows systems, prioritizing internet-facing servers and high-value internal systems.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 91% exploitable

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Unlikely

Data Quality

5 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +35

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).