CVE-2026-49176PoC(microsoft / windows_10_1607)

MEDIUMCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch microsoft windows_10_1607 systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.

microsoft CVEs Back to dashboard

5.0/ 10 priority

Sources & remediation

Patch / fix

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49176

Weakness type (CWE)

CWE-59CWE-269

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
26 mentions across 15 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 11 signals
PoC mentioned or linked in 21 signals
Patch or workaround mentioned in 13 signals
Technical details provided in 25 signals
Peaked 9d ago at 8 mentions (2026-07-27); latest day: 1
26 total mentions across 15 days

Affected systems

Vendors

microsoft

Products

windows_10_1607windows_10_1809windows_10_21h2windows_10_22h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2016windows_server_2019windows_server_2022

Deep dive

Activity timeline26 mentions / 15d

Signal classification3 categories

PoC

1869.2%

Patch

623.1%

Exploit

27.7%

Referenced assets15 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-20	2	PoC2
2026-07-21	2	PoC2
2026-07-22	1	PoC1
2026-07-24	1	Exploit1
2026-07-26	1	PoC1
2026-07-27	8	Patch3PoC5
2026-07-28	3	Patch2PoC1
2026-07-29	1	PoC1
2026-07-31	1	Exploit1
2026-08-10	1	PoC1
2026-08-11	1	PoC1
2026-08-18	1	PoC1
2026-08-20	1	PoC1
2026-09-13	1	PoC1
2026-10-02	1	Patch1

Full discourse20 posts

ThreatWire@ThreatWire_85d
PoC
🚨 A public PoC has been released for CVE-2026-49176, a Windows WalletService privilege escalation vulnerability. Full technical details are now public. Patch affected Windows systems immediately. 🔗 https://github.com/DavidCarliez/CVE-2026-49176_LPE_POC #Windows #LPE #CVE #CyberSecurity
Post summary
A public Proof‑of‑Concept for CVE‑2026‑49176, a Windows WalletService privilege escalation vulnerability, has been released with code on GitHub, and users are advised to patch affected systems immediately.
03701395617.2K
1.5K followersView on X
Nicolas Krassas@Dinosn90d
PoC
Writeup & POC: CVE-2026-49176 Windows WalletService to SYSTEM (LPE) https://davidcarliez.github.io/blog/cve-2026-49176-walletservice-to-system/
Post summary
A writeup and PoC for CVE‑2026‑49176, a local privilege escalation flaw in Windows WalletService, are publicly posted via a blog link, with no active exploitation or patch details mentioned.
025077386.3K
160.9K followersView on X
Dark Web Informer@DarkWebInformer80d
Exploit
🚨 A Cobalt Strike BOF targeting CVE-2026-49176 adds another exploitation method for the CVSS 7.8 Windows WalletService local privilege escalation vulnerability. GitHub: https://github.com/777erp/CVE-2026-49176_BOF The flaw can allow a standard user to execute commands with SYSTEM privileges on unpatched Windows systems.
Post summary
A Cobalt Strike BOF allowing local privilege escalation against Windows WalletService (CVE‑2026‑49176) has been released, providing a functional exploitation method.
014046148.5K
241.7K followersView on X
/r/netsec@_r_netsec37d
PoC
Writeup & POC: CVE-2026-49176 Windows WalletService to SYSTEM (LPE) https://davidcarliez.github.io/blog/cve-2026-49176-walletservice-to-system/
Post summary
The post announces a writeup and Proof of Concept for CVE-2026-49176, a Local Privilege Escalation flaw in Windows WalletService, but does not discuss active exploitation, patches, or debunking.
011039192.3K
34.3K followersView on X
/r/netsec@_r_netsec91d
PoC
Writeup & POC: CVE-2026-49176 Windows WalletService to SYSTEM (LPE) https://davidcarliez.github.io/blog/cve-2026-49176-walletservice-to-system/
Post summary
A writeup and PoC link for CVE-2026-49176 are shared, showcasing a Windows WalletService LPE to SYSTEM.
012041162.3K
33.7K followersView on X
elhacker.NET@elhackernet70d
PoC
Vulnerabilidad en WalletService de Windows permite elevar privilegios: PoC publicado Microsoft ha corregido una vulnerabilidad en WalletService de Windows (identificada como CVE-2026-49176 ) https://blog.elhacker.net/2026/08/vulnerabilidad-en-walletservice-de.html
Post summary
A privilege‑escalation vulnerability in Windows WalletService (CVE‑2026‑49176) has a published proof‑of‑concept, and Microsoft has issued a patch.
01103264.6K
142.4K followersView on X
dbugs@ptdbugs92d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-49176 PT ID: PT-2026-58151 Vendor: Microsoft Product: Windows 10 Version 1607 Description: Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-58151 • https://github.com/DavidCarliez/CVE-2026-49176_LPE_POC #dbugs_vuln
Post summary
A proof‑of‑concept and exploit code for CVE‑2026‑49176’s local privilege escalation in Windows WalletService have been released, but no evidence of active exploitation or remediation was provided.
03032132.5K
3.4K followersView on X
Daily CyberSecurity@Daily_CyberSec85d
PoC
CVE-2026-49176 is a Windows WalletService elevation of privilege flaw. Full details and a public PoC exploit are out, so patch Windows now. #CVE202649176 #WalletService #Windows #PrivilegeEscalation #EoP #PoC #Microsoft http://securityonline.info/cve-2026-49176-walletservice-eop/
Post summary
CVE-2026-49176 is a Windows WalletService elevation of privilege flaw with a public PoC now available; users are urged to patch immediately.
050113833
13.0K followersView on X
0patch@0patch17d
Patch
Micropatches released for Windows WalletService Elevation of Privilege (CVE-2026-49176) https://0patch.com/blog/micropatches-released-for-windows-walletservice-elevation-of-privilege-cve-2026-4 https://t.co/1AvewW14bk
Post summary
The text announces the release of micropatches for the Windows WalletService Elevation of Privilege vulnerability (CVE-2026-49176), focusing primarily on the availability of the fix.
24062694
8.4K followersView on X
yousukezan@yousukezan85d
PoC
WindowsのWalletServiceに権限昇格の脆弱性「CVE-2026-49176」が見つかり、一般ユーザー権限からSYSTEM権限を取得できることが判明した。研究者David Carliezは技術的な詳細と公開PoCを公開しており、MicrosoftはCVSS 7.8の「Important」と評価している。この脆弱性はWindows WalletServiceがLocalSystem権限で動作し、初期設定時にユーザーのDocumentsフォルダー内にあるウォレットデータベースを開く処理に起因する。標準ユーザーはDocumentsフォルダーをリダイレクトして細工したデータベースを配置でき、このデータベースにはExtensible Storage Engine（ESE）の永続コールバック機能が利用されている。WalletServiceがSYSTEM権限でデータベースを開くと、攻撃者が用意したDLLが読み込まれ、権限昇格が成立する。Microsoftは原因をCWE-269およびCWE-59に分類している。影響を受けるのはWindows 10やWindows Serverを含む複数のサポート対象バージョンで、攻撃にはローカルアクセスが必要であり、インターネット経由で悪用されるものではない。Microsoftによると、2026年7月14日に公開した累積更新プログラムで修正済みで、回避策は提供されていない。現時点で実際の悪用は確認されていないが、公開PoCが公開されているため、WalletServiceを実行するsvchostプロセスによる不審なDLL読み込みなどの監視が推奨されている。 https://securityonline.info/cve-2026-49176-walletservice-eop/
Post summary
CVE-2026‑49176 is a local privilege‑escalation flaw in Windows WalletService; a public PoC and detailed technical explanation are available, the issue is patched as of 2026‑07‑14, and no active exploitation has been reported.
010621.9K
15.0K followersView on X
ThreatWire@ThreatWire_92d
PoC
🚨 A public PoC has been released for CVE-2026-49176. The vulnerability affects Microsoft Windows 10 Version 1607 and allows a local privilege escalation (LPE) due to improper privilege management in Windows WalletService. 🔗 https://github.com/DavidCarliez/CVE-2026-49176_LPE_POC #Windows #Microsoft #CVE
Post summary
A public proof‑of‑concept for CVE‑2026‑49176 that exploits a local privilege escalation in Windows WalletService is available on GitHub; no evidence of active exploitation or a patch has been mentioned.
00011216
347 followersView on X
Ronin66@Ronin66Official84d
PoC
CVE-2026-49176: standard user → SYSTEM via WalletService. Create ESE database with persisted callback, redirect Documents folder. WalletService opens it as SYSTEM, loads your DLL. One PowerShell script, no admin. Win11 25H2. https://github.com/DavidCarliez/CVE-2026-49176_LPE_POC #infosec #Windows
Post summary
The post announces the release of a functional LPE PoC for CVE-2026-49176, detailing the exploitation flow and providing a GitHub link to the script.
0001054
25 followersView on X
キタきつね@foxbook85d
PoC
CVE-2026-49176 Windows WalletServiceの特権昇格の脆弱性に対する概念実証（PoC）エクスプロイトが公開される CVE-2026-49176 Windows WalletService Elevation of Privilege Flaw Gets Public PoC Exploit #DailyCyberSecurity (Jul 27) https://securityonline.info/cve-2026-49176-walletservice-eop/
Post summary
A public Proof of Concept exploit for CVE-2026-49176, which is an elevation of privilege flaw in Windows WalletService, has been released. No active exploitation or patch information is provided.
00010384
4.9K followersView on X
Komodo Cyber Security@Komodosec60d
PoC
CVE-2026-49176 Exploit Development: WalletService to SYSTEM https://davidcarliez.github.io/blog/cve-2026-49176-walletservice-to-system/?utm_source=dlvr.it&utm_medium=twitter
Post summary
The tweet shares a link to a blog post detailing an exploit development to elevate WalletService to SYSTEM for CVE-2026-49176, indicating a proof‑of‑concept is available.
0000045
1.5K followersView on X
iototsecnews@iototsecnews63d
PoC
Windows WalletService の脆弱性 CVE-2026-49176：権限昇格のための PoC がリリース https://iototsecnews.jp/2026/08/10/windows-walletservice-vulnerability-allows-attackers-to-escalate-privileges-poc-released/ 紹介されているのは Microsoft Windows の WalletService における権限昇格の欠陥を扱った記事です。サービスが特権コンテキストへ戻る際の不適切な処理に起因して、事前に侵入した攻撃者が SYSTEM 権限を取得できるリスクが存在します。この問題の影響は、端末の完全な乗っ取り／悪用コードの公開による被害拡大であり、対応策は、最新補正プログラムの適用／不要なローカル・ログオンの制限／不審なプロセス作成や DLL ロードの監視です。脆弱性 CVE-2026-49176 に注意して対処を進めることが大切です。 #CVE202649176 #Microsoft #PoC #Vulnerability #WindowsWalletService
Post summary
A PoC for CVE-2026-49176 has been released, exposing a privilege‑escalation flaw in Windows WalletService; the article recommends applying the latest patch and other mitigations.
00000156
507 followersView on X
The Daily Tech Feed@dailytechonx70d
PoC
A critical flaw in Windows WalletService (CVE-2026-49176) enables local attackers to escalate privileges to SYSTEM level. A public PoC is now available, emphasizing the need for immediate application of the July 2026 security updates. Organizations should prioritize patching vulnerable systems and monitor for signs of exploitation to maintain security integrity. #Security #Windows #WalletService #CVE202649176 #CyberSecurity #PatchNow https://thedailytechfeed.com/windows-walletservice-vulnerability-exploited-poc-released/
Post summary
The tweet announces a critical Windows WalletService privilege‑escalation vulnerability, highlights that a public PoC has been released, and urges users to apply the upcoming patch promptly.
0000070
618 followersView on X
Haywood ICON@howol148717283d
PoC
CVE-2026-49176 WalletService LPE → Cobalt Strike BOF Same chain as the public PoC (ESE callback + Documents redirect), but parameterized: run any command/file as SYSTEM on the interactive session. Post-SYSTEM: token steal (winlogon/services/lsass) + service/broker fallback for filtered SYSTEM tokens. https://github.com/777erp/CVE-2026-49176_BOF Research / authorized testing only.
Post summary
The post presents a proof‑of‑concept for CVE‑2026‑49176, offering a Cobalt Strike BOF and GitHub code enabling SYSTEM‑level execution and token theft, with no evidence of active exploitation.
0000055
28 followersView on X
Israel@f1tym184d
Patch
Microsoft addresses CVE-2026-49176, allowing standard users to gain SYSTEM privileges via WalletService on Windows. https://ift.tt/bP3uLCF
Post summary
Microsoft has released a fix for CVE‑2026‑49176, which allows standard users to gain SYSTEM privileges via WalletService on Windows.
0000035
1.0K followersView on X
Rıdvan Yağlı@ridvanyagli84d
Patch
CVE-2026-49176 WalletService LPE açığı microsoft windows temmuz güncellemesinde yamalandı. https://davidcarliez.github.io/blog/cve-2026-49176-walletservice-to-system/
Post summary
CVE-2026-49176, a Local Privilege Escalation flaw in Windows WalletService, was patched in the July Windows update; a blog link provides further details.
00000138
1.3K followersView on X
moton@moton84d
PoC
CVE-2026-49176: Windows WalletService EoP PoC Released - https://securityonline.info/cve-2026-49176-walletservice-eop/
Post summary
A proof‑of‑concept for CVE‑2026‑49176, an elevation‑of‑privilege flaw in Windows WalletService, has been released; no exploit tool, patch, or active exploitation reports are mentioned.
0000073
717 followersView on X

CPE platform detail20 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

20 of 20 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_10_1607	-	-	x64
OS	microsoft	windows_10_1607	-	-	x86
OS	microsoft	windows_10_1809	-	-	x64
OS	microsoft	windows_10_1809	-	-	x86
OS	microsoft	windows_10_21h2	-	-	arm64
OS	microsoft	windows_10_21h2	-	-	x64
OS	microsoft	windows_10_21h2	-	-	x86
OS	microsoft	windows_10_22h2	-	-	arm64
OS	microsoft	windows_10_22h2	-	-	x64
OS	microsoft	windows_10_22h2	-	-	x86
OS	microsoft	windows_11_24h2	-	-	arm64
OS	microsoft	windows_11_24h2	-	-	x64
OS	microsoft	windows_11_25h2	-	-	arm64
OS	microsoft	windows_11_25h2	-	-	x64
OS	microsoft	windows_11_26h1	-	-	arm64
OS	microsoft	windows_11_26h1	-	-	x64
OS	microsoft	windows_server_2016	-	-	-
OS	microsoft	windows_server_2019	-	-	-
OS	microsoft	windows_server_2022	-	-	-
OS	microsoft	windows_server_2025	-	-	-

Explore more

Back to dashboard microsoft CVEs windows_10_1607 vulnerabilities

What researchers are saying

CVE-2026-49176

ThreatWire[verified]@ThreatWire_PoC

A public Proof‑of‑Concept for CVE‑2026‑49176, a Windows WalletService privilege escalation vulnerability, has been released with code on GitHub, and users are advised to patch affected systems immediately.

Nicolas Krassas[verified]@DinosnPoC

A writeup and PoC for CVE‑2026‑49176, a local privilege escalation flaw in Windows WalletService, are publicly posted via a blog link, with no active exploitation or patch details mentioned.

dbugs[verified]@ptdbugsPoC

A proof‑of‑concept and exploit code for CVE‑2026‑49176’s local privilege escalation in Windows WalletService have been released, but no evidence of active exploitation or remediation was provided.

yousukezan[verified]@yousukezanPoC

CVE-2026‑49176 is a local privilege‑escalation flaw in Windows WalletService; a public PoC and detailed technical explanation are available, the issue is patched as of 2026‑07‑14, and no active exploitation has been reported.

キタきつね[verified]@foxbookPoC

A public Proof of Concept exploit for CVE-2026-49176, which is an elevation of privilege flaw in Windows WalletService, has been released. No active exploitation or patch information is provided.

Komodo Cyber Security[verified]@KomodosecPoC

The tweet shares a link to a blog post detailing an exploit development to elevate WalletService to SYSTEM for CVE-2026-49176, indicating a proof‑of‑concept is available.

The Daily Tech Feed[verified]@dailytechonxPoC

The tweet announces a critical Windows WalletService privilege‑escalation vulnerability, highlights that a public PoC has been released, and urges users to apply the upcoming patch promptly.

Haywood ICON[verified]@howol1487172PoC

The post presents a proof‑of‑concept for CVE‑2026‑49176, offering a Cobalt Strike BOF and GitHub code enabling SYSTEM‑level execution and token theft, with no evidence of active exploitation.