CVE-2026-50688

Windows Win32k Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 18th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile18th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which devices run the affected Windows versions (Windows 10/11 and Windows Server 2012–2025) and identify their current OS build/patch level.
Apply the Microsoft security update for CVE-2026-50688, using the fixed versions below for your specific OS.
Reboot the machines after patching, and verify the update is installed successfully.
Review logs and local user activity around the time of patching to spot signs of unusual privilege changes or suspicious account behavior.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-50688 is a Windows local security flaw that lets an already-authorized user raise their privileges on the machine; you should worry if your environment allows untrusted users or accounts to log on to these systems, and you should patch soon because fixes are available.

CVE-2026-50688 is a use-after-free privilege escalation in the Windows kernel that can be triggered by an authorized local attacker to gain higher privileges.

If you're affected

Full system compromise
Malicious account takeover
Data theft risk
Service disruption

What is it

This vulnerability is like a lock that can be tricked into thinking you have a higher clearance than you really do. If someone already has a legitimate logon on the computer, they may be able to break out of that limited access and gain much more control over the whole system.

Who is affected

This matters if you run affected Windows operating systems: Windows 10, Windows 11, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, or 2025. It’s a risk when an attacker can get local authorized access—such as a compromised employee account, a kiosk/terminal with weak access controls, or another insider-like logon.

Reachability gate: it’s only a practical risk if someone can log on locally with authorization on the affected device.

How urgent is it

This is urgent because the vulnerability enables privilege escalation on the local machine, and the traffic-light verdict for CVE-2026-50688 is RED. Even without public exploit code, any scenario involving a compromised or untrusted local account becomes high risk because the flaw is specifically designed to turn limited access into higher privileges.

What to do — in detail

Confirm whether you’re exposed

On each affected machine, confirm the OS edition and version (Windows 10/11; Windows Server 2012/2012 R2/2016/2019/2022/2025).
Identify the current build and patch level for that machine (what your IT calls the “OS build” or “KB level”).
Compare against the fixed versions below for your exact OS line.

Patch to the correct fixed version (per OS)

Windows 10: fixed in one of the following builds:
- 10.0.14393.9339
- 10.0.17763.9020
- 10.0.19044.7548
- 10.0.19045.7548
Windows 11: fixed in one of the following builds:
- 10.0.26100.8875
- 10.0.26200.8875
- 10.0.28000.2525
Windows Server 2012: fixed in 6.2.9200.26226
Windows Server 2012 R2: fixed in 6.3.9600.23291
Windows Server 2016: fixed in 10.0.14393.9339
Windows Server 2019: fixed in 10.0.17763.9020
Windows Server 2022: fixed in 10.0.20348.5386

Upgrade path / compatibility notes

Use Microsoft’s security update from the MSRC update guide entry for CVE-2026-50688 and ensure it matches your OS version/build.
Plan for a reboot after installation (typical for Windows kernel security updates).

If patching is delayed (temporary containment)

Reduce the chance of an attacker getting “authorized local access” by tightening who can log on locally (remove unnecessary local admin rights, review local accounts, and disable/limit interactive logons where feasible).
Prioritize patching on machines most likely to face risky local access (end-user workstations, shared terminals, machines with elevated user privileges).

What to monitor after patching

Look for signs of unusual local privilege changes or suspicious behavior by accounts after any security incident.
Confirm the update is installed correctly and that machines reboot into the expected patched state.

Due date

No CISA KEV entry was listed in the findings provided for this CVE, so no KEV-specific due date can be confirmed from the supplied information.

Technical context

CVE-2026-50688 is a Windows kernel use-after-free (CWE-416) leading to local elevation of privilege. Based on the provided findings, the attack vector is local and the attacker must have local authorized access; there is no user interaction required. While the findings don’t report confirmed public exploit code or CISA KEV listing, Microsoft provides fixed OS build versions for multiple Windows and Windows Server releases. The practical business risk is highest where local logon access is possible for untrusted users or where an account could be compromised, because the flaw is explicitly aimed at turning that local access into higher privileges.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS18th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 18th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 2 days, from the signal feeds we watch.

2026-07-16OpenVAS check addedpatch available, record updated
2026-07-15Record updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 22 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable