What is the CVSS score of EUVD-2026-43944?

EUVD-2026-43944 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Windows RPC are affected by EUVD-2026-43944?

A widespread privilege escalation vulnerability affects Windows Server and Windows 10/11 deployments across most organizations, potentially allowing attackers to gain administrative control of…. A patch is available.

How to fix or mitigate EUVD-2026-43944?

Within 24 hours, inventory all Windows Server 2012-2025 and Windows 10 1607 through Windows 11 26H1 systems in your environment and download the latest Microsoft security patch. Within 7 days, deploy the patch to test and development systems, validate critical applications function correctly, and begin phased production rollout prioritizing systems with sensitive data or critical business functions. Complete patch deployment across all affected Windows systems within 30 days, and verify 100% coverage in your vulnerability management system.

Windows RPC EUVD-2026-43944

| CVE-2026-50365 HIGH

Improper Authentication (CWE-287)

2026-07-14 microsoft

GHSA-wfq2-654c-4wx2

Authentication Bypass Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

8.0

CVSS 3.1 · Vendor: microsoft

Temporal: 7.0

Severity by source

Vendor (microsoft) PRIMARY

8.0 HIGH

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.0 HIGH

cvss

vuln.today AI

8.0 HIGH

Adjacent-network improper-authentication EoP needing no credentials (PR:N) but user interaction (UI:R), with full CIA impact and no scope change, matches the reported vector.

3.1 AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 21:25 vuln.today

CVE Published

Jul 14, 2026 - 17:07 cve.org

HIGH 8.0

DescriptionCVE.org

Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network.

AnalysisAI

Elevation of privilege in the Microsoft Windows RPC API lets an unauthenticated attacker on an adjacent network gain higher privileges by exploiting an improper authentication weakness (CWE-287), provided a user is lured into an interaction. The flaw spans a broad range of client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10 1607 through Windows 11 26H1. No public exploit identified at time of analysis; the issue was reported by Microsoft, which has released a fix.

Technical ContextAI

The vulnerability lives in Windows Remote Procedure Call (RPC), the core inter-process and cross-host communication mechanism that underpins many Windows services (SMB-adjacent services, DCOM, service control, and management interfaces). The root cause is classified as CWE-287 Improper Authentication, meaning the RPC endpoint fails to correctly verify the identity or authorization of a caller, allowing an actor without valid credentials to be treated as a more privileged principal. Because RPC is a foundational OS component, the affected CPE set covers essentially the full supported Windows lineage: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 including Server Core installations.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-50365 via Windows Update or WSUS/SCCM as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50365, prioritizing domain controllers, member servers, and any systems reachable from less-trusted network segments. Exact fixed build numbers are not enumerated in the input, so match the KB to each OS version from the MSRC page. As compensating controls until patching completes, restrict RPC reachability by segmenting VLANs and enforcing host firewall rules that limit inbound RPC endpoint mapper (TCP 135) and dynamic RPC ports to trusted management hosts only - note this can break legitimate management, remote administration, and clustering traffic if scoped too tightly. Since exploitation requires user interaction over an adjacent network, also reinforce user awareness and reduce exposure of workstations to untrusted local network segments (guest Wi-Fi, shared LANs).