CVE-2026-50311: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-50311 Overview

CVE-2026-50311 is an improper access control vulnerability [CWE-284] affecting a broad range of Microsoft Windows client and server operating systems. An authorized local attacker can exploit the flaw to elevate privileges on the affected host. Microsoft assigned the issue a CVSS 3.1 score of 7.8, reflecting local attack vector, low complexity, low privileges required, and high impact to confidentiality, integrity, and availability.

The vulnerability affects Windows 10, Windows 11, and Windows Server editions from Server 2012 through Server 2025. Microsoft published guidance in the Microsoft Security Update Guide for CVE-2026-50311.

Critical Impact
A low-privileged local user can gain SYSTEM-level privileges across every supported Windows client and server release, enabling full host compromise.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-50311 published to the National Vulnerability Database
2026-07-17 - Last updated in NVD database
2026-07-20 - EPSS score published at 0.23%

Technical Details for CVE-2026-50311

Vulnerability Analysis

CVE-2026-50311 is categorized under [CWE-284] Improper Access Control. The affected Windows component fails to enforce correct access restrictions on a privileged resource. An authorized user on the local system can interact with that resource in a way that was intended to be restricted to higher-privileged principals.

Because the flaw resides in a component shipped across all currently supported Windows client and server SKUs, the exposure surface spans virtually every enterprise Windows estate. Successful exploitation results in the attacker gaining SYSTEM-level execution context, which allows tampering with security controls, credential theft from lsass.exe, persistence installation, and lateral movement staging.

Root Cause

Microsoft's advisory attributes the issue to improper access control in a Windows component. The component does not correctly validate the caller's privilege level before permitting an action that modifies protected system state. This class of flaw commonly arises when discretionary access control lists (DACLs) on kernel objects, registry keys, or named pipes grant broader access than intended.

Attack Vector

The attack vector is local. An attacker must first hold valid, low-privileged credentials on the target host, obtained through phishing, credential reuse, or a prior foothold from a separate initial-access vulnerability. From that context, the attacker invokes the vulnerable interface to trigger the access control failure and receive elevated privileges. No user interaction is required, and the scope remains unchanged (S:U), meaning the impact is confined to the compromised host.

A public proof-of-concept is not available at the time of publication, and CISA has not added the issue to the Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-50311

Indicators of Compromise

Unexpected creation of processes running as NT AUTHORITY\SYSTEM spawned from standard user sessions.
Anomalous access to sensitive registry hives (HKLM\SAM, HKLM\SECURITY) or attempts to open lsass.exe with elevated access rights following logon by a non-administrative account.
New service creation, scheduled task registration, or driver installation events originating from low-privileged user contexts.

Detection Strategies

Correlate Windows Security event ID 4672 (special privileges assigned) with the preceding logon event ID 4624 to flag privilege assignments to accounts that should not receive them.
Baseline parent-child process relationships and alert on standard-user processes launching cmd.exe, powershell.exe, or LOLBins as SYSTEM.
Hunt for token manipulation and impersonation patterns using Sysmon event IDs 1 (process creation) and 10 (process access) targeting high-integrity processes.

Monitoring Recommendations

Ingest Windows Security, Sysmon, and PowerShell operational logs into a centralized SIEM and retain them for at least 90 days to support retroactive hunting.
Monitor patch compliance across all Windows client and server assets to identify hosts still exposed to CVE-2026-50311.
Track deviations from established privileged-access baselines, especially on domain controllers and Tier 0 systems running Windows Server 2019, 2022, or 2025.

How to Mitigate CVE-2026-50311

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-50311 to all affected Windows client and server systems.
Prioritize patching of internet-facing servers, jump hosts, and multi-user systems where low-privileged accounts routinely execute code.
Audit local and domain accounts to remove unnecessary interactive logon rights on servers and reduce the population of users who can trigger the vulnerability.

Patch Information

Microsoft has released fixed updates through the standard Windows Update and Microsoft Update Catalog channels. Refer to the Microsoft Security Update Guide entry for CVE-2026-50311 for the specific KB article numbers that correspond to each affected Windows build.

Workarounds

Microsoft has not published an official workaround; installing the security update is the supported remediation.
As a compensating control, enforce the principle of least privilege, restrict local logon rights via Group Policy, and enable attack surface reduction (ASR) rules that limit LOLBin abuse.
Deploy application allow-listing (Windows Defender Application Control or AppLocker) on high-value hosts to constrain the tools an attacker can execute after achieving initial local access.

bash

# Verify patch status on a Windows host by listing installed updates
wmic qfe list brief /format:table

# Force Windows Update to check for and install the CVE-2026-50311 fix
UsoClient StartScan
UsoClient StartDownload
UsoClient StartInstall