Security Advisory

CVE-2026-50406

Windows Backup Engine Elevation of Privilege Vulnerability

Published

14 Jul 2026, 17:07 UTC

CVSS

7 · High (v3.1)

Weakness

CWE-416

Assigning CNA

microsoft

High 7CVSS 3.1CWE-416

Description

Use after free in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

Severity (CVSS)

Base score	7
Severity	High
Version	CVSS 3.1
Vector	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Provided by	CNA

Weaknesses

CWE-416 — CWE-416: Use After Free

Affected products

Vendor	Product	Versions
Microsoft	Windows 10 Version 21H2	10.0.19044.0 to <10.0.19044.7548
Microsoft	Windows 10 Version 22H2	10.0.19045.0 to <10.0.19045.7548
Microsoft	Windows 11 Version 24H2	10.0.26100.0 to <10.0.26100.8875
Microsoft	Windows 11 Version 25H2	10.0.26200.0 to <10.0.26200.8875
Microsoft	Windows 11 version 26H1	10.0.28000.0 to <10.0.28000.2269

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50406 (vendor-advisory patch)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 15 Jul 2026 07:06 UTC.