CVE-2026-50667

Windows Common Log File System Driver Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 10th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile10th0.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-22Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which affected Windows edition your devices run (Windows 10/11 or the listed Windows Server versions).
Confirm whether your system is currently below the fixed build numbers listed by your vendor/IT update channel.
Upgrade/patch Windows so it is at or above the fixed versions for your branch (use the exact fixed versions in the “what_to_do_full” section).
If patching is delayed, restrict who can log on locally and reduce the chance of an “authorized” user being available (tight access controls and least privilege).
After patching, verify Windows build/version matches the fixed minimum for your OS branch and monitor for suspicious privilege escalation activity (local admin creation, unexpected scheduled tasks, and system service changes).

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-50667 is a Windows bug in the NTFS driver where a local user can potentially use a timing “race” to gain higher privileges; typical small businesses should patch because it affects many Windows versions but is not a drive-by internet attack.

CVE-2026-50667 is a local race condition in the Windows NTFS driver (CWE-362) that can let an authenticated/authorized user escalate privileges without needing user interaction.

If you're affected

System administrator privilege gain
Full server or workstation takeover
Malware easier to run as SYSTEM
Loss of control of sensitive data

What is it

This vulnerability is a flaw in a Windows file system component (NTFS) where two operations can overlap in a way that lets someone with local access try to “win a timing race.” If they succeed, they may be able to jump from normal access to near-superuser control on that machine—like grabbing the keys to the building rather than just an office door. Because it’s local, it typically requires someone to already have a foothold on the device (like an account), not just visiting a website.

Who is affected

This matters if you run or manage Windows 10, Windows 11, or any of the listed Windows Server versions (2012/2012 R2/2016/2019/2022/2025). The key point is reachability: it’s a local privilege-escalation issue, meaning it’s primarily a risk when an attacker already has an account or other authorized local access on your machine. It does not indicate a default “internet-to-admin” exposure from the findings.

How urgent is it

This is RED because it can allow a local, authorized user to escalate privileges by exploiting a race condition in the NTFS driver. While exploitation details aren’t clearly confirmed in dated reporting, you should treat it as an urgent patching item for systems where untrusted or potentially compromised local accounts could exist. Patch promptly to reduce the chance that an existing foothold becomes full control.

What to do — in detail

Identify affected systems
- Collect the OS name/version/build for each device/VM (Windows 10/11 and Windows Server 2012/2012 R2/2016/2019/2022/2025).
Determine whether each system is below the fixed build
- Compare the system’s current build number against the fixed versions below (for the matching OS branch).
Patch to the fixed version (target these minimums)
- Windows 10:
  - Fixed in 10.0.14393.9339
  - Fixed in 10.0.17763.9020
  - Fixed in 10.0.19044.7548
  - Fixed in 10.0.19045.7548
- Windows 11:
  - Fixed in 10.0.26100.8875
  - Fixed in 10.0.26200.8875
  - Fixed in 10.0.28000.2525
- Windows Server 2012:
  - Fixed in 6.2.9200.26226
- Windows Server 2012 R2:
  - Fixed in 6.3.9600.23291
- Windows Server 2016:
  - Fixed in 10.0.14393.9339
- Windows Server 2019:
  - Fixed in 10.0.17763.9020
- Windows Server 2022:
  - Fixed in 10.0.20348.5386
Upgrade considerations / breaking changes
- Use standard Windows Update or your enterprise patching process; plan a restart window because Windows driver/component updates typically require reboot.
Temporary workaround if you cannot patch immediately
- Reduce the chance of an attacker having local authorized access: tighten local logon permissions, remove unnecessary local accounts, and ensure least-privilege across user accounts.
What to monitor after updating
- Look for indicators consistent with privilege escalation on any patched machines: unexpected creation/modification of local administrators, unusual service installation, scheduled tasks created by non-admin users, and other high-privilege command execution patterns.
Exploitation timeline
- KEV listing is not present in the provided findings, and there is no clear dated public exploitation report in the press from the provided findings—however the vulnerability is still being actively addressed via patch releases (per findings).

Technical context

Severity/impact: Locally exploitable privilege escalation (Windows NTFS/CLFS driver race). The weakness is CWE-362 (race condition) and the core finding describes improper synchronization using a shared resource, enabling a local authorized user to potentially elevate privileges without user interaction.

Attack vector and prerequisites: Local exploitation with low authentication requirements and no user interaction per the findings; exploitability depends on an attacker already having some level of authorized local access (exact conditions are not fully specified in the findings).

Exploit maturity: No public exploit code was found in the provided findings, and KEV was not listed; no clear dated real-world exploitation claim is included in the provided news. This means there’s no confirmed public exploit code evidence from the provided sources, but patch availability across many supported branches indicates active mitigation.

Patch status: Multiple fixed builds are provided across Windows 10, Windows 11, and several Windows Server versions, which should be used as the minimum remediation targets.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS10th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 10th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 8 days, from the signal feeds we watch.

2026-07-22Patch availablerecord updated
2026-07-16OpenVAS check addedrecord updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 22 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable