Microsoft has fixed CVE-2026-50486, an Important-rated Windows Runtime vulnerability that could let a locally authenticated attacker elevate privileges. The flaw carries a CVSS 3.1 base score of 7.8 and affects supported Windows 10 installations, Windows 11 versions 24H2 through 26H1, and Windows Server 2025.
Detailed in Microsoft’s July 14, 2026 Security Update Guide, CVE-2026-50486 is a use-after-free memory-management bug. Microsoft says exploitation requires local access and existing low-level privileges, but no interaction from another user once the attack begins.
The vulnerability was not publicly disclosed before the update, and Microsoft has not reported exploitation in the wild. CISA’s initial assessment likewise records no known exploitation and says automated exploitation is not expected, although a successful attack could have a total technical impact on the compromised system.
A use-after-free vulnerability occurs when software continues to reference memory after that memory has been released. If an attacker can manipulate what replaces the freed data, the stale reference may be turned into memory corruption and, under the right conditions, controlled code execution.
Microsoft has not published the vulnerable function, proof-of-concept code, or a step-by-step attack scenario for CVE-2026-50486. The available CVSS vector nevertheless establishes the important boundaries: the attack is local, has low complexity, requires low privileges, and needs no user interaction. Scope remains unchanged, meaning exploitation stays within the security authority of the affected Windows component rather than directly crossing into another security domain.
The confidentiality, integrity, and availability impact values are all rated High. In practical terms, Microsoft believes successful exploitation could allow an attacker to access protected information, modify system data, and disrupt the machine.
That makes CVE-2026-50486 a post-compromise escalation vulnerability, not a vulnerability that can ordinarily be used to break into an exposed Windows PC directly over the internet. An attacker would first need a working account, malware running as a restricted user, a compromised application, or another route to execute code locally.
This distinction lowers its value as an initial-access tool but does not make it harmless. Privilege-escalation bugs are frequently paired with phishing, malicious downloads, browser vulnerabilities, remote-management credential theft, or application sandbox escapes. The elevation stage can turn a constrained intrusion into administrative control, making it possible to disable defenses, access other users’ files, establish persistence, or steal credentials.
Report confidence measures Microsoft’s certainty that the vulnerability exists and that the published technical assessment is credible. In this case, Microsoft, as the Windows vendor and CVE Numbering Authority, has confirmed the underlying flaw and shipped an official correction. The rating does not reveal whether exploit code is available to outsiders or whether criminals have attempted to use it.
The public evidence currently points in the opposite direction on active exploitation. The National Vulnerability Database records CISA’s exploitation status as “none,” while the Zero Day Initiative’s July Patch Tuesday review lists CVE-2026-50486 as neither public nor exploited. The NVD was still awaiting its own enrichment analysis on July 15, relying on Microsoft’s CVSS score and affected-version data.
That leaves an important uncertainty: researchers and defenders know the weakness class and affected builds, but Microsoft has withheld enough implementation detail to prevent a meaningful assessment of exploit reliability. Patch comparison could eventually reveal more about the corrected Windows Runtime code, so the absence of public technical details should not become a reason to postpone deployment.
The Windows 11 package includes servicing-stack update KB5120102 for the 26100 branch. Microsoft reported no known issues with KB5101650 at publication, although administrators should still run their standard application, driver, VPN, security-agent, and device-management compatibility tests before broad deployment.
Windows Server 2025 deserves particular attention because both the Desktop Experience and Server Core installation options are affected. Server Core’s reduced interface does not remove the vulnerable Windows Runtime code from the threat model. KB5099536 is the relevant July cumulative update and raises the server build to 26100.33158.
The Windows 10 entries require additional context. Windows 10 version 22H2 left general support on October 14, 2025, so ordinary consumer and business devices need Extended Security Updates to continue receiving fixes. Windows 10 Enterprise LTSC 2021, represented by the 19044 branch, remains within its applicable servicing lifecycle, while unsupported installations without ESU cannot treat a successful update check as proof that CVE-2026-50486 has been addressed.
Remote Desktop Session Hosts, developer workstations, shared administrative jump boxes, application servers, virtual desktop infrastructure, and endpoints used by privileged personnel carry greater practical risk. A compromised low-privilege account on those systems may provide access to substantially more valuable credentials and data after elevation.
Organizations that cannot deploy immediately should concentrate interim controls on preventing the initial foothold. Application control through Windows Defender Application Control or AppLocker, removal of unnecessary local accounts, endpoint detection and response monitoring, credential isolation, and restrictions on script interpreters can reduce opportunities to reach the vulnerable local component. Microsoft has not documented a vulnerability-specific workaround, so those measures are layers of containment rather than substitutes for the update.
Administrators can confirm remediation with
The immediate objective is straightforward: move Windows 11 24H2 and 25H2 to KB5101650, Windows Server 2025 to KB5099536, and eligible Windows 10 systems to KB5099539. Until those build numbers are in place, an attacker who already has limited local access retains a documented path toward full compromise of the Windows host.
Detailed in Microsoft’s July 14, 2026 Security Update Guide, CVE-2026-50486 is a use-after-free memory-management bug. Microsoft says exploitation requires local access and existing low-level privileges, but no interaction from another user once the attack begins.
The vulnerability was not publicly disclosed before the update, and Microsoft has not reported exploitation in the wild. CISA’s initial assessment likewise records no known exploitation and says automated exploitation is not expected, although a successful attack could have a total technical impact on the compromised system.
A Local Foothold Could Become Full Control
A use-after-free vulnerability occurs when software continues to reference memory after that memory has been released. If an attacker can manipulate what replaces the freed data, the stale reference may be turned into memory corruption and, under the right conditions, controlled code execution.Microsoft has not published the vulnerable function, proof-of-concept code, or a step-by-step attack scenario for CVE-2026-50486. The available CVSS vector nevertheless establishes the important boundaries: the attack is local, has low complexity, requires low privileges, and needs no user interaction. Scope remains unchanged, meaning exploitation stays within the security authority of the affected Windows component rather than directly crossing into another security domain.
The confidentiality, integrity, and availability impact values are all rated High. In practical terms, Microsoft believes successful exploitation could allow an attacker to access protected information, modify system data, and disrupt the machine.
That makes CVE-2026-50486 a post-compromise escalation vulnerability, not a vulnerability that can ordinarily be used to break into an exposed Windows PC directly over the internet. An attacker would first need a working account, malware running as a restricted user, a compromised application, or another route to execute code locally.
This distinction lowers its value as an initial-access tool but does not make it harmless. Privilege-escalation bugs are frequently paired with phishing, malicious downloads, browser vulnerabilities, remote-management credential theft, or application sandbox escapes. The elevation stage can turn a constrained intrusion into administrative control, making it possible to disable defenses, access other users’ files, establish persistence, or steal credentials.
The Confirmed Rating Describes Evidence, Not Active Attacks
The “Confirmed” report-confidence metric in Microsoft’s advisory can be easy to misread. It does not mean attacks have been confirmed in customer environments.Report confidence measures Microsoft’s certainty that the vulnerability exists and that the published technical assessment is credible. In this case, Microsoft, as the Windows vendor and CVE Numbering Authority, has confirmed the underlying flaw and shipped an official correction. The rating does not reveal whether exploit code is available to outsiders or whether criminals have attempted to use it.
The public evidence currently points in the opposite direction on active exploitation. The National Vulnerability Database records CISA’s exploitation status as “none,” while the Zero Day Initiative’s July Patch Tuesday review lists CVE-2026-50486 as neither public nor exploited. The NVD was still awaiting its own enrichment analysis on July 15, relying on Microsoft’s CVSS score and affected-version data.
That leaves an important uncertainty: researchers and defenders know the weakness class and affected builds, but Microsoft has withheld enough implementation detail to prevent a meaningful assessment of exploit reliability. Patch comparison could eventually reveal more about the corrected Windows Runtime code, so the absence of public technical details should not become a reason to postpone deployment.
July Updates Establish the Safe Build Line
Microsoft’s affected-version ranges identify the first non-vulnerable builds. Administrators should verify the installed OS build rather than merely checking whether Windows Update recently ran.- Windows 10 version 21H2 must be updated to build 19044.7548 through KB5099539.
- Windows 10 version 22H2 must be updated to build 19045.7548 through KB5099539.
- Windows 11 version 24H2 must be updated to build 26100.8875 through KB5101650.
- Windows 11 version 25H2 must be updated to build 26200.8875 through KB5101650.
- Windows 11 version 26H1 is not affected on build 28000.2269 or later, with the July KB5101649 release advancing devices to build 28000.2525.
- Windows Server 2025 and Server Core must be updated to build 26100.33158 through KB5099536.
The Windows 11 package includes servicing-stack update KB5120102 for the 26100 branch. Microsoft reported no known issues with KB5101650 at publication, although administrators should still run their standard application, driver, VPN, security-agent, and device-management compatibility tests before broad deployment.
Windows Server 2025 deserves particular attention because both the Desktop Experience and Server Core installation options are affected. Server Core’s reduced interface does not remove the vulnerable Windows Runtime code from the threat model. KB5099536 is the relevant July cumulative update and raises the server build to 26100.33158.
The Windows 10 entries require additional context. Windows 10 version 22H2 left general support on October 14, 2025, so ordinary consumer and business devices need Extended Security Updates to continue receiving fixes. Windows 10 Enterprise LTSC 2021, represented by the 19044 branch, remains within its applicable servicing lifecycle, while unsupported installations without ESU cannot treat a successful update check as proof that CVE-2026-50486 has been addressed.
Deployment Should Follow Existing Escalation Priorities
CVE-2026-50486 does not require emergency isolation of internet-facing systems because its attack vector is local. It should, however, remain in the normal high-priority Windows cumulative-update queue, particularly on multi-user systems and machines where untrusted code is more likely to execute.Remote Desktop Session Hosts, developer workstations, shared administrative jump boxes, application servers, virtual desktop infrastructure, and endpoints used by privileged personnel carry greater practical risk. A compromised low-privilege account on those systems may provide access to substantially more valuable credentials and data after elevation.
Organizations that cannot deploy immediately should concentrate interim controls on preventing the initial foothold. Application control through Windows Defender Application Control or AppLocker, removal of unnecessary local accounts, endpoint detection and response monitoring, credential isolation, and restrictions on script interpreters can reduce opportunities to reach the vulnerable local component. Microsoft has not documented a vulnerability-specific workaround, so those measures are layers of containment rather than substitutes for the update.
Administrators can confirm remediation with
winver, PowerShell inventory, Microsoft Intune, Configuration Manager, WSUS reporting, or their vulnerability-management platform. Scanners should ultimately validate the installed build against Microsoft’s fixed-version thresholds rather than flagging every device that merely reports Windows Runtime as present.The immediate objective is straightforward: move Windows 11 24H2 and 25H2 to KB5101650, Windows Server 2025 to KB5099536, and eligible Windows 10 systems to KB5099539. Until those build numbers are in place, an attacker who already has limited local access retains a documented path toward full compromise of the Windows host.
References
- Primary source: MSRC
Published: 2026-07-14T07:00:00-07:00
Security Update Guide - Microsoft Security Response Center
msrc.microsoft.com
- Related coverage: aha.org
- Related coverage: tomshardware.com
Windows Server vulnerability can grant system privileges with just a malformed packet — domain controllers are being exploited in the wild | Tom's Hardware
System administrators, run the May 12 patch immediately if you haven't already.www.tomshardware.com
