Microsoft has patched CVE-2026-50480, a high-severity elevation-of-privilege flaw in the Windows Web Proxy Auto-Discovery Protocol, with the July 14, 2026 security updates. The vulnerability is a heap-based buffer overflow that can let a locally authorized attacker gain higher privileges without requiring another user to interact with the system.
Detailed in the Microsoft Security Response Center’s Security Update Guide, CVE-2026-50480 carries a CVSS 3.1 base score of 7.8. Microsoft’s published affected-product data points specifically to Windows 10 version 1607, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016, including Server Core installations.
Administrators running those releases should treat the July update as a privilege-boundary fix rather than dismissing it as an obscure proxy configuration issue. An attacker must already have local access with limited privileges, but successful exploitation could provide control over confidentiality, integrity, and availability at the higher privilege level.
Microsoft describes CVE-2026-50480 as a heap-based buffer overflow, tracked under CWE-122. This class of memory-safety error occurs when software writes more data to a heap allocation than the destination can hold, potentially corrupting adjacent memory and changing program behavior.
The CVSS vector is
That makes CVE-2026-50480 unsuitable as an initial entry point from the public internet, based on the currently published assessment. Its value is more likely to come after an attacker has obtained a foothold through stolen credentials, malicious software, an exposed service, or another vulnerability.
Once inside, privilege-escalation bugs can help an intruder break out of a constrained account and take actions that the original access level would not permit. Those actions may include accessing protected data, changing security settings, tampering with services, installing persistent components, or disrupting the host.
Microsoft assigns high impact to all three core security properties: confidentiality, integrity, and availability. The vulnerability’s scope remains unchanged, meaning exploitation affects resources governed by the same security authority rather than crossing into a separately managed component.
WPAD has a long security history because automatic discovery can create opportunities for network interception when DNS, DHCP, suffix-search behavior, or naming controls are poorly managed. CVE-2026-50480, however, should not be reduced to the familiar scenario of an attacker simply registering or advertising a rogue proxy.
Microsoft’s description identifies the root cause as a heap-based buffer overflow and classifies the impact as local elevation of privilege. The published CVSS vector also requires existing low-level privileges on the affected machine. That distinguishes this advisory from a conventional remote WPAD spoofing or credential-capture warning.
Microsoft has not publicly provided enough technical detail to identify the exact malformed structure, API path, or Windows component involved in triggering the overflow. Administrators therefore should not assume that disabling a browser’s automatic proxy-detection checkbox fully removes exposure unless Microsoft explicitly documents that setting as a mitigation.
No separate workaround or compensating control was identified in the public CVE record available at publication. Installing the official Windows security update is the dependable remediation.
The listed vulnerable versions and corrected build thresholds are:
Windows Server 2012 and Windows Server 2012 R2 require particular attention because they are beyond their standard support lifecycle. Organizations still receiving fixes for those systems generally depend on Microsoft’s Extended Security Updates program or an eligible Azure servicing arrangement.
That support status changes the deployment question. A vulnerable server without the necessary ESU entitlement may not receive the correction through its normal update channel, even though the CVE lists the product as affected. Inventory results should therefore be checked against both the installed build and the machine’s servicing eligibility.
Windows 10 version 1607 is similarly an old branch whose remaining deployments are likely to involve specialized servicing editions, embedded use cases, or unusually static enterprise systems. Those devices are often harder to restart and may sit outside the organization’s normal desktop update rings, making explicit verification important.
At the time of publication, the National Vulnerability Database was still awaiting its own enrichment work and displayed Microsoft’s CVSS assessment. CISA’s initial Stakeholder-Specific Vulnerability Categorization data marked exploitation as “none,” automation as “no,” and potential technical impact as total.
Those indicators support a measured but prompt response. CVE-2026-50480 was not identified as an actively exploited zero-day in the initial public records, and the local-access requirement reduces its usefulness for broad unauthenticated attacks. It nevertheless offers a potentially powerful privilege-escalation step on systems an attacker has already penetrated.
Security teams should watch for revisions from Microsoft, CISA, and vulnerability researchers. Exploitability assessments can change after patches are reverse-engineered, particularly when a memory-corruption flaw has low attack complexity and does not require user interaction.
Organizations should also identify systems that could not receive the update because of ESU licensing, disconnected update infrastructure, failed servicing stacks, or maintenance-window restrictions. Those exceptions deserve documented risk treatment and closer monitoring until they can be patched, upgraded, isolated, or retired.
Disabling unnecessary automatic proxy discovery may still reduce an environment’s broader WPAD attack surface, but Microsoft’s public material does not establish it as a complete workaround for this specific memory-corruption flaw. The decisive milestone is the corrected Windows build: 14393.9339 for Windows 10 version 1607 and Server 2016, 9200.26226 for Server 2012, or 9600.23291 for Server 2012 R2.
Detailed in the Microsoft Security Response Center’s Security Update Guide, CVE-2026-50480 carries a CVSS 3.1 base score of 7.8. Microsoft’s published affected-product data points specifically to Windows 10 version 1607, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016, including Server Core installations.
Administrators running those releases should treat the July update as a privilege-boundary fix rather than dismissing it as an obscure proxy configuration issue. An attacker must already have local access with limited privileges, but successful exploitation could provide control over confidentiality, integrity, and availability at the higher privilege level.
The Attack Starts Locally but Does Not Stay Limited
Microsoft describes CVE-2026-50480 as a heap-based buffer overflow, tracked under CWE-122. This class of memory-safety error occurs when software writes more data to a heap allocation than the destination can hold, potentially corrupting adjacent memory and changing program behavior.The CVSS vector is
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. In practical terms, the attack is local, has low complexity, requires low privileges, and does not need a victim to open a file, click a link, or approve a prompt.That makes CVE-2026-50480 unsuitable as an initial entry point from the public internet, based on the currently published assessment. Its value is more likely to come after an attacker has obtained a foothold through stolen credentials, malicious software, an exposed service, or another vulnerability.
Once inside, privilege-escalation bugs can help an intruder break out of a constrained account and take actions that the original access level would not permit. Those actions may include accessing protected data, changing security settings, tampering with services, installing persistent components, or disrupting the host.
Microsoft assigns high impact to all three core security properties: confidentiality, integrity, and availability. The vulnerability’s scope remains unchanged, meaning exploitation affects resources governed by the same security authority rather than crossing into a separately managed component.
WPAD’s Familiar Name Masks a Memory-Safety Problem
WPAD is designed to help Windows systems locate proxy configuration automatically. In managed environments, it can participate in discovering a Proxy Auto-Configuration file through mechanisms such as DHCP or DNS, allowing browsers and other applications to obtain network proxy settings without requiring each device to be configured manually.WPAD has a long security history because automatic discovery can create opportunities for network interception when DNS, DHCP, suffix-search behavior, or naming controls are poorly managed. CVE-2026-50480, however, should not be reduced to the familiar scenario of an attacker simply registering or advertising a rogue proxy.
Microsoft’s description identifies the root cause as a heap-based buffer overflow and classifies the impact as local elevation of privilege. The published CVSS vector also requires existing low-level privileges on the affected machine. That distinguishes this advisory from a conventional remote WPAD spoofing or credential-capture warning.
Microsoft has not publicly provided enough technical detail to identify the exact malformed structure, API path, or Windows component involved in triggering the overflow. Administrators therefore should not assume that disabling a browser’s automatic proxy-detection checkbox fully removes exposure unless Microsoft explicitly documents that setting as a mitigation.
No separate workaround or compensating control was identified in the public CVE record available at publication. Installing the official Windows security update is the dependable remediation.
The Affected List Centers on Older Windows Generations
The vulnerability record names a comparatively narrow set of Windows releases. Current Windows 11 editions and newer Windows Server generations do not appear in Microsoft’s published affected-product list for CVE-2026-50480.The listed vulnerable versions and corrected build thresholds are:
- Windows 10 version 1607 on 32-bit and x64 systems is affected before build 10.0.14393.9339.
- Windows Server 2012 and its Server Core installation are affected before build 6.2.9200.26226.
- Windows Server 2012 R2 and its Server Core installation are affected before build 6.3.9600.23291.
- Windows Server 2016 and its Server Core installation are affected before build 10.0.14393.9339.
winver, PowerShell, their endpoint-management platform, or Windows Update reporting rather than relying only on whether an update installation task completed.Windows Server 2012 and Windows Server 2012 R2 require particular attention because they are beyond their standard support lifecycle. Organizations still receiving fixes for those systems generally depend on Microsoft’s Extended Security Updates program or an eligible Azure servicing arrangement.
That support status changes the deployment question. A vulnerable server without the necessary ESU entitlement may not receive the correction through its normal update channel, even though the CVE lists the product as affected. Inventory results should therefore be checked against both the installed build and the machine’s servicing eligibility.
Windows 10 version 1607 is similarly an old branch whose remaining deployments are likely to involve specialized servicing editions, embedded use cases, or unusually static enterprise systems. Those devices are often harder to restart and may sit outside the organization’s normal desktop update rings, making explicit verification important.
Report Confidence Is Not Exploit Evidence
The report-confidence language supplied with the advisory indicates that the vulnerability is confirmed. In CVSS terminology, that means credible technical evidence exists or the vendor has acknowledged the issue; it does not mean attackers have published a working exploit or are using the flaw in the wild.At the time of publication, the National Vulnerability Database was still awaiting its own enrichment work and displayed Microsoft’s CVSS assessment. CISA’s initial Stakeholder-Specific Vulnerability Categorization data marked exploitation as “none,” automation as “no,” and potential technical impact as total.
Those indicators support a measured but prompt response. CVE-2026-50480 was not identified as an actively exploited zero-day in the initial public records, and the local-access requirement reduces its usefulness for broad unauthenticated attacks. It nevertheless offers a potentially powerful privilege-escalation step on systems an attacker has already penetrated.
Security teams should watch for revisions from Microsoft, CISA, and vulnerability researchers. Exploitability assessments can change after patches are reverse-engineered, particularly when a memory-corruption flaw has low attack complexity and does not require user interaction.
Patch Verification Matters More Than WPAD Guesswork
The immediate administrative action is to deploy the July 14, 2026 Windows security update to affected and supported systems, then confirm that each machine has reached the corrected build for its release. Server Core is explicitly included, so the absence of a desktop interface does not remove exposure.Organizations should also identify systems that could not receive the update because of ESU licensing, disconnected update infrastructure, failed servicing stacks, or maintenance-window restrictions. Those exceptions deserve documented risk treatment and closer monitoring until they can be patched, upgraded, isolated, or retired.
Disabling unnecessary automatic proxy discovery may still reduce an environment’s broader WPAD attack surface, but Microsoft’s public material does not establish it as a complete workaround for this specific memory-corruption flaw. The decisive milestone is the corrected Windows build: 14393.9339 for Windows 10 version 1607 and Server 2016, 9200.26226 for Server 2012, or 9600.23291 for Server 2012 R2.
References
- Primary source: MSRC
Published: 2026-07-14T07:00:00-07:00
Security Update Guide - Microsoft Security Response Center
msrc.microsoft.com
