Vulnerability report

CVE-2026-50423

Windows Kernel Elevation of Privilege Vulnerability

Microsoft / Windows 10 Version 21H2 · affected before 10.0.19044.7548

Watch CVE-2026-50423 Browse KEV feed
Severity
CVSS 7.8 · High
Confidence
—
Exploit status
—
EPSS
—
First observed
—
Last observed
—

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-50423 is Windows Kernel Elevation of Privilege Vulnerability affecting Microsoft Windows 10 Version 21H2 and 7 other products. Improper access control in Windows Kernel allows an authorized attacker to...

Have exploitation attempts been observed?

No. Previdian has not recorded exploitation attempts for this vulnerability yet.

Who is affected?

Microsoft / Windows 10 Version 21H2 affected before 10.0.19044.7548.

What should we do?

Track for updates. Assess relevance to your asset inventory and enrichment workflows.

Overview

Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally

Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.

Microsoft Affected
Windows 10 Version 21H2
Before 10.0.19044.7548
Microsoft Affected
Windows 10 Version 22H2
Before 10.0.19045.7548
Microsoft Affected
Windows 11 Version 24H2
Before 10.0.26100.8875
Microsoft Affected
Windows 11 Version 25H2
Before 10.0.26200.8875
Microsoft Affected
Windows 11 version 26H1
Before 10.0.28000.2525
Microsoft Affected
Windows Server 2022
Before 10.0.20348.5386
Microsoft Affected
Windows Server 2025
Before 10.0.26100.33158
Microsoft Affected
Windows Server 2025 (Server Core installation)
Before 10.0.26100.33158
View vendor advisory (opens in new tab)
Published
14 Jul 2026
Exploitation date
—
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None

Tags

windows microsoft

CVE References

Exploitation evidence

Exploitation evidence for this CVE

Catalogues and sources that list this CVE as a known exploited vulnerability, when available.

No exploitation evidence rows are recorded for this CVE yet.

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

7.8 High

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

EPSS

—

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Improper Access Control CWE-284

Recent mention · Rapid7

Patch Tuesday - July 2026

Microsoft is publishing 622 vulnerabilities on July 2026 Patch Tuesday, including a record-breaking 416 Windows vulnerabilities. Microsoft is aware of exploitation in the wild for two of the vulnerabilities published today, both of which are listed on CISA KEV, as well as...

Read full advisory

Timeline

From disclosure to today

  1. 17:07 UTC

    CVE published

    Vulnerability disclosed publicly

  2. 18:56 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-50423

Sample API response 
{
  "cve_id": "CVE-2026-50423",
  "confidence": null,
  "cvss_score": 7.8,
  "cvss_estimated": false,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": false,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}