CVE-2026-50509

Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 89th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile89th3.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-22Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your exact Windows version/build (Windows 10/11 or Windows Server 2016/2019/2025) and whether Wireless Wide Area Network Service (WwanSvc) is installed/enabled on affected machines.
Update each affected machine to a fixed build listed by Microsoft for your specific OS.
Reboot after patching, then verify the new OS build number matches the fixed version for that branch.
If patching is delayed, restrict who can obtain local access to the affected machines (physical access, local accounts, remote helpdesk sessions), and review local login/activity logs for suspicious behavior.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

A Windows networking feature (WwanSvc) has a flaw where someone who already has local access can raise their privileges to run as the highest system level—this is serious for businesses that let untrusted people reach a PC.

CVE-2026-50509 is a local privilege escalation in Windows Wireless Wide Area Network Service (WwanSvc) caused by unsafe deserialization of untrusted data, allowing an authorized local attacker to gain higher system privileges without user interaction.

If you're affected

Full system takeover
Malware persistence
Ransomware enabling
Total data access

What is it

Think of WwanSvc as a piece of Windows “helper software” that manages wireless wide-area networking. This bug lets a person who already has a foothold on the machine (local access) trick that helper into granting them much higher permissions, like unlocking the keys to the whole computer. That can turn ordinary access into full control.

Who is affected

This matters if your business runs Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, or Windows Server 2025 on devices where an attacker could get local access (for example, stolen laptops, shared physical access, or a compromised local account). The vulnerability requires local access by an authorized attacker and does not require user interaction. It’s only a risk when the attacker can reach the machine locally and target the WwanSvc path in that environment (exact default reachability isn’t confirmed in the provided findings).

How urgent is it

Treat this as urgent because it enables local privilege escalation: once someone has local access, they can potentially gain full system control. Even though there’s no clear public, dated exploitation claim in the provided reporting and no public exploit code on record, the issue’s impact (system-level elevation) is high and the fix is available for multiple Windows versions. This is therefore a RED item for remediation planning and execution.

What to do — in detail

Confirm exposure on each device
- Identify the OS edition: Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, or Windows Server 2025.
- Record the current OS version/build number from the machine.
- Confirm the machine actually uses WwanSvc (Wireless Wide Area Network Service). At minimum, patch all machines in scope unless you can confidently confirm WwanSvc is not present/used in your environment.
Patch to the fixed version for your exact OS branch
- Windows 10 fixed in: 10.0.14393.9339; 10.0.17763.9020; 10.0.19044.7548; 10.0.19045.7548
- Windows 11 fixed in: 10.0.26100.8875; 10.0.26200.8875; 10.0.28000.2525
- Windows Server 2016 fixed in: 10.0.14393.9339
- Windows Server 2019 fixed in: 10.0.17763.9020
- Windows Server 2025 fixed in: 10.0.26100.33158
- Use the Microsoft update guide entry for CVE-2026-50509 to choose the correct update(s) for your device.
Validate after patching
- Reboot the machine.
- Re-check the OS build number and confirm it matches (or is higher than) the fixed build for the corresponding branch listed above.
Temporary workaround if you can’t patch immediately
- Reduce the chance of local attacker presence by tightening physical access and local/admin account access.
- If staff use remote support tools, ensure those sessions are controlled and logged.
What to monitor
- Look for suspicious local logons and privilege changes around the time of any security incidents.
- Prioritize investigation on systems where there were signs of local compromise (unexpected admin activity, new local accounts, or abnormal service/process behavior).

Technical context

CVE-2026-50509 is a Windows local privilege escalation vulnerability in Wireless Wide Area Network Service (WwanSvc). The underlying weakness is CWE-502 (unsafe deserialization of untrusted data). Impact is high because an authorized local attacker can elevate privileges to higher system levels without needing user interaction.

Findings indicate low authentication requirements (the attacker must be authorized and have local access) and a local attack vector. KEV listing was not provided, and press reporting does not include a clear dated exploitation claim; no public exploit code is recorded in the provided findings. A patch is available via Microsoft for multiple Windows 10/11 and Windows Server versions; update guidance is available under the MSRC page for the CVE. Overall, the practicality is driven by the “local access” requirement combined with the ability to escalate to more powerful privileges once that condition is met.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS89th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

3.5% chance of exploitation activity in the next 30 days, which ranks it in the 89th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 8 days, from the signal feeds we watch.

2026-07-22Patch availablerecord updated
2026-07-16OpenVAS check added
2026-07-15Record updatedrecord updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 18 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable