CVE-2026-50365: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-50365 Overview

CVE-2026-50365 is an improper authentication vulnerability [CWE-287] in the Windows Remote Procedure Call (RPC) API. An unauthorized attacker on an adjacent network can leverage the flaw to elevate privileges on affected Windows systems. Successful exploitation requires user interaction, but no prior authentication or privileges are needed on the target.

The vulnerability affects a broad range of Windows client and server releases, including Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Microsoft has published a security update through the Microsoft Security Response Center (MSRC).

Critical Impact
An adjacent-network attacker who convinces a user to interact with a crafted RPC request can obtain elevated privileges, compromising confidentiality, integrity, and availability on the targeted host.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
Microsoft Windows 11 (versions 24H2, 25H2, 26H1) across x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-50365 published to the National Vulnerability Database (NVD)
2026-07-20 - Last updated in the NVD database

Technical Details for CVE-2026-50365

Vulnerability Analysis

CVE-2026-50365 stems from improper authentication handling within the Windows RPC API. The RPC subsystem underpins inter-process and inter-host communication for many core Windows services. When authentication checks are not enforced correctly, an attacker can invoke privileged RPC operations without possessing valid credentials.

The flaw is exploitable from an adjacent network, meaning the attacker must share a logical network segment such as the same Wi-Fi, VLAN, or broadcast domain as the target. Exploitation also requires user interaction on the victim host, which typically means enticing a user to open a document, click a link, or accept a prompt that triggers the vulnerable RPC path.

Because RPC frequently runs in the context of high-privilege system services, successful exploitation grants the attacker elevated privileges on the target. This provides a foothold for lateral movement, credential theft, and persistent access.

Root Cause

The root cause is an authentication weakness classified under [CWE-287]. The vulnerable RPC interface accepts and processes requests without adequately verifying the caller's identity, allowing crafted messages to be treated as if they came from an authorized principal.

Attack Vector

The attack vector is adjacent-network. An attacker positioned on the same local network segment as the victim sends specially crafted RPC traffic to the target. Combined with user interaction on the victim system, the exploit path allows the attacker to bypass authentication and execute operations with elevated privileges. No public proof-of-concept exploit code is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-50365

Indicators of Compromise

Unexpected RPC traffic on TCP port 135 or dynamic RPC endpoint ports originating from unmanaged devices on the local subnet
New or unusual service processes spawned by svchost.exe or rpcss shortly after inbound RPC activity
Sudden privilege changes on user accounts, including additions to local Administrators or privileged groups

Detection Strategies

Monitor Windows Security event logs for anomalous privilege elevation events (Event IDs 4672, 4673, 4674) that correlate with recent RPC connections
Enable RPC endpoint mapper auditing and alert on repeated failed authentication attempts followed by successful privileged calls
Baseline normal RPC caller-callee relationships and flag deviations, particularly requests to sensitive interfaces from non-domain hosts

Monitoring Recommendations

Deploy network segmentation controls and monitor east-west RPC traffic between client subnets where such traffic is not required
Correlate endpoint telemetry with network flow data to identify adjacent-network exploitation attempts
Review authentication and privilege-escalation events across managed Windows endpoints for patterns consistent with RPC abuse

How to Mitigate CVE-2026-50365

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Response Center advisory for CVE-2026-50365 to all affected Windows client and server systems
Prioritize patching of systems on shared or untrusted network segments, including guest Wi-Fi adjacent to corporate resources
Audit privileged account activity on systems that may have been exposed prior to patching

Patch Information

Microsoft has released fixes for all affected Windows versions through the standard Windows Update channel. Refer to the Microsoft Security Update guide for the specific KB articles and package identifiers that apply to each build.

Workarounds

Restrict inbound RPC traffic (TCP 135 and dynamic RPC ports) at host and network firewalls to trusted management subnets only
Enforce network segmentation to isolate client workstations from one another and from server infrastructure where RPC access is not required
Require authenticated and encrypted RPC where supported, and disable legacy RPC interfaces that are not needed in the environment

bash

# Example: block inbound RPC endpoint mapper traffic from untrusted subnets using Windows Defender Firewall
New-NetFirewallRule -DisplayName "Block Inbound RPC EPM" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 135 `
  -RemoteAddress Any `
  -Action Block `
  -Profile Any