CVE-2026-50352 exposes sensitive information through Windows Cryptographic Services, and Microsoft has shipped the fix in its July 14, 2026 security updates. The flaw affects supported Windows 10, Windows 11, and Windows Server releases, but exploitation requires an attacker who already has local access and valid privileges.
Microsoft rates the vulnerability Important, with a CVSS 3.1 base score of 5.5. Detailed in the Microsoft Security Response Center advisory and the National Vulnerability Database, the issue is classified as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Administrators should deploy the July cumulative updates rather than wait for more technical disclosure. Microsoft says exploitation is less likely, and the vulnerability was neither publicly disclosed nor known to be exploited when the update was published.
The CVSS vector for CVE-2026-50352 is
A successful exploit can have a high confidentiality impact. Microsoft does not attribute any integrity or availability impact, so the vulnerability is not described as a route to modify protected content, crash Windows, or directly gain higher privileges.
That distinction matters when triaging July’s much larger security release. CVE-2026-50352 is not a remote code execution flaw that an unauthenticated internet attacker can immediately use against an exposed service. It is better understood as a post-access information disclosure primitive: something an attacker could potentially use after compromising an account or gaining another foothold on the machine.
Microsoft has not publicly identified the precise information that can be exposed. The available description says only that an authorized local attacker can disclose sensitive information through Windows Cryptographic Services. It does not confirm whether the exposed material consists of key-related data, process memory, cryptographic metadata, credentials, certificate information, or another protected resource.
That uncertainty should prevent overly specific claims about stolen private keys or certificate compromise. It should not, however, be interpreted as proof that the impact is negligible. The CVSS confidentiality rating is high, indicating that Microsoft considers the information accessible through successful exploitation potentially significant.
The corrected build thresholds listed in Microsoft’s CVE record include:
For Windows 10 version 22H2, the July fix arrives in KB5099539, raising the operating system to build 19045.7548. That update applies to machines still covered through Windows 10 ESU and to supported LTSC editions where applicable.
Administrators should verify the installed cumulative update or OS build, not merely rely on a successful update scan. A machine can report no immediately available updates while still sitting on a superseded release because of servicing policies, deployment rings, safeguard holds, WSUS approval status, or an earlier installation failure.
What remains limited is the technical depth of the public record. Microsoft has not published a root-cause analysis, exploitation sequence, affected Windows component or function, observable event-log pattern, or specific type of data that may escape its intended security boundary.
That gap affects defenders and attackers differently. Security teams cannot yet create highly targeted behavioral detections for exploitation, but would-be attackers also lack a vendor-provided map of the vulnerable code path. Reverse engineering the pre-update and post-update binaries could eventually reveal the changed logic, which is one reason delayed patching becomes less defensible as time passes.
The National Vulnerability Database marked the record as awaiting enrichment on July 14. Its initial entry repeats Microsoft’s description and score rather than adding an independent technical assessment.
Microsoft’s “exploitation less likely” judgment is useful for prioritization, but it is not a guarantee that exploit code will never emerge. The low attack complexity encoded in the CVSS vector suggests that once the relevant code path is understood, exploitation may not require unusually restrictive conditions. The main barrier is the need for local access and some existing privilege.
Remote Desktop Session Host servers, administrative jump boxes, build systems, certificate-management hosts, and machines running several services under separate identities deserve closer attention. So do systems where attackers could combine CVE-2026-50352 with phishing, malicious documents, exposed credentials, or another vulnerability that provides the initial local foothold.
The appropriate response is straightforward:
CVE-2026-50352 is therefore a conventional Patch Tuesday problem with an unusually opaque impact description: moderate numerical severity, local prerequisites, but potentially serious data exposure after compromise. Until Microsoft or an independent researcher documents exactly what can be disclosed, the corrected Windows build is the clearest security boundary administrators can verify.
Microsoft rates the vulnerability Important, with a CVSS 3.1 base score of 5.5. Detailed in the Microsoft Security Response Center advisory and the National Vulnerability Database, the issue is classified as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Administrators should deploy the July cumulative updates rather than wait for more technical disclosure. Microsoft says exploitation is less likely, and the vulnerability was neither publicly disclosed nor known to be exploited when the update was published.
Local Access Limits the Attack but Not the Value of the Data
The CVSS vector for CVE-2026-50352 is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. In practical terms, an attacker must operate locally, the attack has low complexity, low-level privileges are required, and no additional user interaction is necessary.A successful exploit can have a high confidentiality impact. Microsoft does not attribute any integrity or availability impact, so the vulnerability is not described as a route to modify protected content, crash Windows, or directly gain higher privileges.
That distinction matters when triaging July’s much larger security release. CVE-2026-50352 is not a remote code execution flaw that an unauthenticated internet attacker can immediately use against an exposed service. It is better understood as a post-access information disclosure primitive: something an attacker could potentially use after compromising an account or gaining another foothold on the machine.
Microsoft has not publicly identified the precise information that can be exposed. The available description says only that an authorized local attacker can disclose sensitive information through Windows Cryptographic Services. It does not confirm whether the exposed material consists of key-related data, process memory, cryptographic metadata, credentials, certificate information, or another protected resource.
That uncertainty should prevent overly specific claims about stolen private keys or certificate compromise. It should not, however, be interpreted as proof that the impact is negligible. The CVSS confidentiality rating is high, indicating that Microsoft considers the information accessible through successful exploitation potentially significant.
The Affected List Reaches Across Windows Generations
Microsoft’s affected-product data covers current Windows 11 systems as well as older Windows and Windows Server branches receiving security maintenance. Both x64 and Arm64 editions are affected where those architectures are supported, while older Windows 10 releases also include 32-bit systems.The corrected build thresholds listed in Microsoft’s CVE record include:
- Windows 10 version 1607 and Windows Server 2016 are corrected at build 14393.9339.
- Windows 10 version 1809 and Windows Server 2019 are corrected at build 17763.9020.
- Windows 10 version 21H2 is corrected at build 19044.7548.
- Windows 10 version 22H2 is corrected at build 19045.7548.
- Windows 11 version 24H2 is corrected at build 26100.8875.
- Windows 11 version 25H2 is corrected at build 26200.8875.
- Windows 11 version 26H1 receives the correction through the July servicing release.
- Windows Server 2022 is corrected at build 20348.5386.
- Windows Server 2025 is corrected at build 26100.33158.
For Windows 10 version 22H2, the July fix arrives in KB5099539, raising the operating system to build 19045.7548. That update applies to machines still covered through Windows 10 ESU and to supported LTSC editions where applicable.
Administrators should verify the installed cumulative update or OS build, not merely rely on a successful update scan. A machine can report no immediately available updates while still sitting on a superseded release because of servicing policies, deployment rings, safeguard holds, WSUS approval status, or an earlier installation failure.
Microsoft Has Confirmed the Bug Without Publishing the Recipe
The vulnerability’s existence is not speculative. Microsoft assigned the CVE, supplied the affected-product ranges, issued a CVSS vector, and delivered security updates, providing a high level of confidence that the underlying defect is real.What remains limited is the technical depth of the public record. Microsoft has not published a root-cause analysis, exploitation sequence, affected Windows component or function, observable event-log pattern, or specific type of data that may escape its intended security boundary.
That gap affects defenders and attackers differently. Security teams cannot yet create highly targeted behavioral detections for exploitation, but would-be attackers also lack a vendor-provided map of the vulnerable code path. Reverse engineering the pre-update and post-update binaries could eventually reveal the changed logic, which is one reason delayed patching becomes less defensible as time passes.
The National Vulnerability Database marked the record as awaiting enrichment on July 14. Its initial entry repeats Microsoft’s description and score rather than adding an independent technical assessment.
Microsoft’s “exploitation less likely” judgment is useful for prioritization, but it is not a guarantee that exploit code will never emerge. The low attack complexity encoded in the CVSS vector suggests that once the relevant code path is understood, exploitation may not require unusually restrictive conditions. The main barrier is the need for local access and some existing privilege.
Patch Priority Depends on What Shares the Machine
Workstations with strong application control, standard-user accounts, and limited exposure to untrusted code carry less immediate risk than shared servers or multi-user systems. The flaw becomes more consequential wherever one user or process must be prevented from learning sensitive information belonging to another security context.Remote Desktop Session Host servers, administrative jump boxes, build systems, certificate-management hosts, and machines running several services under separate identities deserve closer attention. So do systems where attackers could combine CVE-2026-50352 with phishing, malicious documents, exposed credentials, or another vulnerability that provides the initial local foothold.
The appropriate response is straightforward:
- Deploy the July 14, 2026 cumulative security update for every affected Windows release.
- Confirm that endpoints and servers have reached the corrected build rather than checking only whether an update job completed.
- Investigate unexplained local account access, suspicious process execution, and credential misuse because Microsoft has not documented a unique exploitation indicator.
- Prioritize shared and security-sensitive hosts if operational constraints prevent simultaneous deployment across the fleet.
- Avoid treating endpoint protection as a substitute for the servicing fix, since the vulnerable behavior resides in a Windows security component.
CVE-2026-50352 is therefore a conventional Patch Tuesday problem with an unusually opaque impact description: moderate numerical severity, local prerequisites, but potentially serious data exposure after compromise. Until Microsoft or an independent researcher documents exactly what can be disclosed, the corrected Windows build is the clearest security boundary administrators can verify.
References
- Primary source: MSRC
Published: 2026-07-14T07:00:00-07:00
Security Update Guide - Microsoft Security Response Center
msrc.microsoft.com
- Related coverage: www2.gov.bc.ca
