CVE-2026-50423 is a Windows Kernel improper access control vulnerability that can lead to elevation of privilege to SYSTEM. Microsoft rates it as CVSS v3.1 7.8 base / 6.8 temporal, with a LOCAL attack vector, LOW attack complexity, LOW privileges required, and no user interaction. Microsoft has not reported public disclosure or active exploitation, and exploit code maturity is UNPROVEN. Because exploitation requires local access, enterprise risk is higher on systems where an attacker can already run code or obtain local access, rather than on network-facing services.

Highlights:
- CVSS scores: Base 7.8 - Temporal 6.8
- Exploit status & code maturity: Publicly Disclosed: No; Exploited: No; Exploit Code Maturity: UNPROVEN.
- Impact: Elevation of Privilege; confidentiality, integrity, and availability impacts are all HIGH; successful exploitation can grant SYSTEM privileges.
- Exploitation likelihood: Exploitation More Likely; vector context is LOCAL, with LOW attack complexity, LOW privileges required, and NO user interaction.
- Severity for enterprise: High technical severity due to full SYSTEM-level impact, but lower exposure than remote vulnerabilities because exploitation is local-only.
- Patch status: available; customer action required.

Affected systems:
- Windows 10 21H2
- Windows 10 22H2
- Windows 11 24H2
- Windows 11 25H2
- Windows 11 26H1
- Windows 11 unspecified
- Windows Server 2022
- Windows Server 2025