CVE-2026-50364: Windows 10 21h2 Privilege Escalation Flaw

CVE-2026-50364 Overview

CVE-2026-50364 is an elevation of privilege vulnerability in Windows Server Backup caused by improper link resolution before file access [CWE-59]. An authorized local attacker can abuse symbolic link handling to redirect privileged file operations to attacker-controlled locations. Successful exploitation grants the attacker higher privileges on the affected host, with high impact to confidentiality, integrity, and availability.

The issue affects multiple current Windows client builds, including Windows 10 21H2, Windows 10 22H2, and Windows 11 24H2, 25H2, and 26H1 across x86, x64, and ARM64 architectures. Exploitation requires local access, low privileges, and user interaction.

Critical Impact
A local, authenticated user can leverage link-following in Windows Server Backup to gain elevated privileges and fully compromise the affected system.

Affected Products

Microsoft Windows 10 21H2 (x86, x64, ARM64)
Microsoft Windows 10 22H2 (x86, x64, ARM64)
Microsoft Windows 11 24H2, 25H2, and 26H1 (x64, ARM64)

Discovery Timeline

2026-07-14 - CVE-2026-50364 published to the National Vulnerability Database (NVD)
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-50364

Vulnerability Analysis

CVE-2026-50364 stems from unsafe link resolution in Windows Server Backup. The service performs file operations on paths without verifying whether components resolve through symbolic links, junctions, or hard links. A local user can plant a link that redirects a privileged write, delete, or open operation to a sensitive target.

Because Windows Server Backup runs with elevated rights, the redirected operation executes in a higher security context than the attacker. This allows the attacker to overwrite protected files, tamper with system configuration, or place code in locations that grant SYSTEM-level execution. The end result is local privilege elevation on the affected Windows host.

Root Cause

The root cause is a missing or insufficient check on file path resolution before access, categorized as [CWE-59] Improper Link Resolution Before File Access. The backup component trusts pre-resolved paths and does not enforce that final targets remain within an approved directory or reject reparse points during privileged operations.

Attack Vector

Exploitation requires local access and a low-privileged authenticated user session, along with user interaction. The attacker prepares a directory or file that Windows Server Backup will touch during a backup, restore, or configuration action. That path contains a crafted symbolic link or junction pointing to a protected system location.

When the privileged backup operation follows the link, it performs its file action on the attacker's chosen target. The technique aligns with well-documented Windows link-abuse patterns used to convert arbitrary file write or delete primitives into SYSTEM-level code execution.

No public proof-of-concept or in-the-wild exploitation has been reported for CVE-2026-50364 as of the last NVD update. The EPSS probability remains low, consistent with a local, interaction-dependent vector.

Detection Methods for CVE-2026-50364

Indicators of Compromise

Creation of symbolic links, junctions, or hard links inside directories used by Windows Server Backup (wbengine.exe, wbadmin.exe) by non-administrative accounts.
Unexpected modifications to protected system files or DLLs in C:\Windows\System32 correlated in time with a backup or restore operation.
New or altered scheduled tasks and services following a Windows Server Backup run initiated by a standard user.

Detection Strategies

Monitor process activity for wbengine.exe and wbadmin.exe writing to paths outside their expected working directories.
Alert on reparse point creation (Sysmon Event ID 11 with reparse indicators, or file system minifilter telemetry) in staging paths owned by non-privileged users.
Correlate low-privileged user sessions triggering Windows Server Backup operations with subsequent SYSTEM-level process creation.

Monitoring Recommendations

Enable Windows object access auditing on backup-related directories and on sensitive targets such as System32, drivers, and service configuration keys.
Ingest endpoint file, process, and registry telemetry into a centralized data lake to enable retrospective hunts for link-abuse patterns tied to CVE-2026-50364.
Track Microsoft Security Response Center advisory updates for Microsoft Security Update CVE-2026-50364 and update detections when Microsoft publishes additional guidance.

How to Mitigate CVE-2026-50364

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-50364 to all affected Windows 10 and Windows 11 builds.
Restrict who can invoke Windows Server Backup operations to trusted administrative accounts only.
Audit endpoints for the presence of Windows Server Backup and prioritize patching on systems where the feature is enabled.

Patch Information

Microsoft has published guidance and update packages for CVE-2026-50364 through the Microsoft Update Guide. Deploy the vendor-supplied patches for each affected build (Windows 10 21H2, Windows 10 22H2, Windows 11 24H2, 25H2, and 26H1) across x86, x64, and ARM64 architectures. Consult the Microsoft Security Update CVE-2026-50364 page for KB numbers and installation prerequisites.

Workarounds

Disable the Windows Server Backup feature on systems that do not require it until patches can be applied.
Prevent standard users from creating symbolic links by removing the SeCreateSymbolicLinkPrivilege right where it is not needed via Group Policy.
Store backup working directories on volumes and paths where non-administrative users have no write access, reducing the opportunity to plant malicious links.

bash

# Remove SeCreateSymbolicLinkPrivilege from standard users via secedit
# Export current policy
secedit /export /cfg C:\secpol.cfg

# Edit C:\secpol.cfg and remove non-admin SIDs from:
# SeCreateSymbolicLinkPrivilege = *S-1-5-32-544

# Reapply policy
secedit /configure /db C:\Windows\security\local.sdb /cfg C:\secpol.cfg /areas USER_RIGHTS