CVE-2026-50346

Analyzed Analyzed - Analysis Complete

Improper Authorization in RPC Runtime

Publication date: 2026-07-14

Last updated on: 2026-07-22

Assigner: Microsoft Corporation

Description

Improper authorization in RPC Runtime allows an authorized attacker to elevate privileges locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-22

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-50346

EUVD

EUVD-2026-43927

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_server_2012	r2
microsoft	windows_server_2012	*
microsoft	windows_11_26h1	to 10.0.28000.2269 (exc)
microsoft	windows_10_1607	to 10.0.14393.9339 (exc)
microsoft	windows_10_1607	to 10.0.14393.9339 (exc)
microsoft	windows_10_1809	to 10.0.17763.9020 (exc)
microsoft	windows_10_1809	to 10.0.17763.9020 (exc)
microsoft	windows_server_2016	to 10.0.14393.9339 (exc)
microsoft	windows_server_2019	to 10.0.17763.9020 (exc)
microsoft	windows_server_2022	to 10.0.20348.5386 (exc)
microsoft	windows_server_2025	to 10.0.26100.33158 (exc)
microsoft	windows_11_26h1	to 10.0.28000.2525 (exc)
microsoft	windows_11_24h2	to 10.0.26100.8875 (exc)
microsoft	windows_11_24h2	to 10.0.26100.8875 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7548 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7548 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7548 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7548 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7548 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7548 (exc)
microsoft	windows_11_25h2	to 10.0.26200.8875 (exc)
microsoft	windows_11_25h2	to 10.0.26200.8875 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper authorization issue in the RPC Runtime component. An authorized attacker can exploit it to elevate their privileges locally on a system.

Detection Guidance

Detection of this vulnerability requires checking for unauthorized privilege escalation attempts in RPC Runtime. Monitor system logs for unusual privilege elevation events and inspect RPC Runtime processes for abnormal behavior. Use tools like Windows Event Viewer to review security logs for Event ID 4672 (Special Privileges Assigned) or Event ID 4688 (Process Creation) with elevated tokens.

Impact Analysis

An attacker with local access could gain higher privileges than intended, potentially allowing them to perform unauthorized actions or access sensitive data on the affected system.

Mitigation Strategies

Apply the latest security updates from Microsoft to address the improper authorization in RPC Runtime. Monitor Microsoft's security advisories for patches and ensure all systems are updated promptly.

Hi! I’m here to help you understand CVE-2026-50346. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70