CVE-2026-50343PoC(microsoft / windows_10_1809)

MEDIUMCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch microsoft windows_10_1809 systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally.

microsoft CVEs Back to dashboard

4.8/ 10 priority

Sources & remediation

Patch / fix

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50343

Weakness type (CWE)

CWE-269

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_24h2

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
26 mentions across 12 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 10 signals
PoC mentioned or linked in 13 signals
Patch or workaround mentioned in 4 signals
Technical details provided in 19 signals
Disclosure: 6 classified signals
Peaked 9d ago at 6 mentions (2026-07-22); latest day: 1
26 total mentions across 12 days

Affected systems

Vendors

microsoft

Products

windows_10_1809windows_10_21h2windows_10_22h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2019windows_server_2022windows_server_2025

Deep dive

Activity timeline26 mentions / 12d

Signal classification5 categories

PoC

1038.5%

Disclosure

623.1%

Exploit

415.4%

General

415.4%

Patch

27.7%

Referenced assets19 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	1	Patch1
2026-07-16	4	PoC4
2026-07-22	6	Disclosure2Exploit1General2PoC1
2026-07-23	1	PoC1
2026-08-04	2	PoC2
2026-08-05	1	Exploit1
2026-08-06	2	General1PoC1
2026-08-18	1	Disclosure1
2026-09-21	1	General1
2026-09-22	5	Disclosure2Exploit1Patch1PoC1
2026-09-24	1	Exploit1
2026-09-30	1	Disclosure1

Full discourse20 posts

Calif@calif_io83d
Disclosure
Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343) A pure-logic, 100% reliable path from a normal user to SYSTEM on Windows 11. Full write-up: https://open.substack.com/pub/calif/p/dark-elevator-windows-install-service?r=26yra9&utm_campaign=post&utm_medium=web https://t.co/URreK2HuZB
Post summary
The tweet announces CVE‑2026‑50343, highlighting a reliable LPE path on Windows 11, and links to a detailed write-up, but does not provide PoC code, patch info, or evidence of active exploitation.
366422711937.9K
7.0K followersView on X
nad@Nadsec1190d
PoC
CVE-2026-50343 - InstallService Windows local privilege Escelation - Writeup and POC Found another cool one! https://github.com/Rat5ak/CVE-2026-50343-InstallService-EoP not sure who first to find was, but shoutout to them. Despite not being FTF, my mom thinks it's cool and that's all that matters 😎
Post summary
A write‑up and proof‑of‑concept for CVE‑2026‑50343, a Windows local privilege‑elevation flaw, are posted on GitHub, with no evidence of active exploitation or available patch.
257019212311.2K
701 followersView on X
Natalie Silvanovich@natashenka22d
General
In July, Microsoft fixed CVE-2026-50343, a Windows privilege escalation bug reported by Calif and 9 others, dubbed “Dark Elevator”. But was it really fixed? Ask @tiraniddo https://projectzero.google/2026/09/windows-dangling-com.html
Post summary
The text references CVE-2026-50343, a Windows privilege escalation bug, and questions whether Microsoft's fix was effective, but does not provide PoC, exploit code, or evidence of active exploitation.
34622149817.4K
45.8K followersView on X
🕳@sekurlsa_pw83d
General
https://github.com/califio/publications/tree/main/MADBugs/windows-CVE-2026-50343 https://t.co/i7CMgXQDk6
Post summary
The post shares a link to a GitHub repository concerning CVE‑2026‑50343 but does not provide any PoC, exploit, patch, or technical detail.
03111639316.6K
2.7K followersView on X
Hack32@Hack32_69d
Exploit
Public Exploit Code Released for CVE-2026-50343, a Windows InstallService Flaw That Grants SYSTEM Privileges https://securityonline.info/cve-2026-50343-privilege-escalation/ 🔥
Post summary
Public exploit code for CVE-2026-50343, a Windows InstallService privilege‑escalation flaw, has been released; no active exploitation or patch information is mentioned.
0310124587.8K
828 followersView on X
Daily CyberSecurity@Daily_CyberSec70d
PoC
Details and proof-of-concept exploit code for CVE-2026-50343 are now public. The Windows privilege escalation flaw hands standard users SYSTEM privileges. #CVE202650343 #Windows #PrivilegeEscalation #LPE #InfoSec http://securityonline.info/cve-2026-50343-privilege-escalation/
Post summary
Proof‑of‑concept code for the Windows privilege escalation CVE‑2026‑50343 is now publicly available; there is no indication of active exploitation or an existing patch.
020073423.7K
13.0K followersView on X
Casey@_subTee83d
PoC
Don't get me wrong. I love exploits, priv esc. But when I read this... https://github.com/califio/publications/blob/main/MADBugs/windows-CVE-2026-50343/blog.md "Drop a malicious DLL at that path, a folder any normal user can write to." Oh... Well. ok... I once again point to AppControl. WDAC... https://t.co/U2VlX7XNMJ
Post summary
The tweet references a blog that appears to contain a PoC for CVE‑2026‑50343, describing a privilege‑escalation technique involving dropping a malicious DLL into a writable directory, but offers no evidence of active exploitation, patches, or detailed technical specifics.
5302381.9K
346 followersView on X
blackorbird@blackorbird22d
Patch
CVE-2026-66804 is a Windows local privilege-escalation bug (an incomplete fix for “Dark Elevator,” CVE-2026-50343) involving a dangling COM registration. A system-wide CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} (CrossDevice) pointed at a missing DLL under %PROGRAMDATA%\CrossDevice\.... Because ProgramData is user-writable, an attacker can plant a malicious DLL there. Instantiating that COM class then loads the DLL. The earlier InstallService path was patched, so exploitation used custom COM marshaling: a Custom OBJREF with that CLSID is sent to a privileged process that still allows custom unmarshaling. James Forshaw used the Shell Create Object Handler (dllhost as SYSTEM), started via the user-startable \Microsoft\Windows\Shell\CreateObjectTask scheduled task plus a global event, then passed a fake marshaled object through ICreateObject. Unmarshaling loads the planted DLL as SYSTEM. Microsoft has fixed the dangling registration. The post also notes the same marshaling trick can abuse other dangling COM classes or buggy custom unmarshalers, and includes a PowerShell scan to find similar missing in-proc servers. https://projectzero.google/2026/09/windows-dangling-com.html
Post summary
The post describes a Windows local privilege-escalation vulnerability involving a dangling COM registration and notes that Microsoft has issued a fix, while also detailing the vulnerability's mechanics and providing a detection script.
07020102.2K
44.1K followersView on X
hackyboiz@hackyboiz214d
Disclosure
[1day1line] CVE-2026-50343: LPE in Windows InstallService caused by Improper Privilege Management Hello, this is banda. Today's 1day1line covers a privilege escalation vulnerability in Windows InstallService. A standard user can specify a COM class through StaticPluginMap and use a writable CrossDevice DLL path to load an attacker-controlled DLL with SYSTEM privileges. This vulnerability is known as Dark Elevator. Please refer to the blog post for details! https://hackyboiz.github.io/2026/09/30/banda/CVE-2026-50343/
Post summary
The tweet discloses CVE‑2026‑50343 (Dark Elevator), a Windows InstallService LPE where a standard user can load a malicious DLL through a COM class and CrossDevice DLL path to achieve SYSTEM privileges.
04017111.1K
583 followersView on X
Clandestine@akaclandestine89d
PoC
https://github.com/Rat5ak/CVE-2026-50343-InstallService-EoP
Post summary
The link points to a GitHub repository containing a proof‑of‑concept for CVE‑2026‑50343, with exploit code and technical details, but no evidence of active exploitation or patch information.
0501672.3K
64.1K followersView on X
dbugs@ptdbugs19d
Exploit
CVE-2026-66804: dangling COM registration leads to SYSTEM in Windows Read on dbugs: https://dbu.gs/news/cve-2026-66804-dangling-com-registration-leads-to-system-in-windows-20260924 James Forshaw from Google Project Zero analyzed CVE-2026-66804 (https://dbu.gs/vulnerability/CVE-2026-66804) — an LPE in Windows caused by an incomplete fix for the earlier CVE-2026-50343 (https://dbu.gs/vulnerability/CVE-2026-50343) (Dark Elevator). The system retained a CrossDevice COM registration with the CLSID "{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}", pointing to a missing "%PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll". Because regular users can create directories under "C:\ProgramData", an attacker can plant their own DLL at the expected path. The main challenge is getting a privileged process to load it. Forshaw used custom COM marshaling: an object implementing "IMarshal" can specify an arbitrary CLSID to use during unmarshaling, causing the COM runtime to look up the corresponding in-process server and load its DLL. Exploitation therefore requires a privileged COM server that does not disable custom marshaling. Forshaw found one in the Shell Create Object Handler, hosted in "dllhost.exe" as "NT AUTHORITY\SYSTEM" with "CustomMarshalAllowed=True". A regular user can start the privileged server through the "\Microsoft\Windows\Shell\CreateObjectTask" scheduled task, after creating the global "ShellCreateObjectTaskReadyEvent" event. The attacker can then pass a specially crafted COM object to the "ICreateObject" interface. During unmarshaling, COM resolves the CrossDevice CLSID and loads the planted DLL from "%PROGRAMDATA%" into the SYSTEM process, resulting in privilege escalation. Forshaw published a fully working exploit. He also included a PowerShell script using "OleViewDotNet" and "NtObjectManager" to identify other registered in-process COM classes whose DLLs cannot be found by "LoadLibrary". The resulting paths must then be manually checked to determine whether an attacker can plant a DLL there. Forshaw notes that the same exploitation technique can simplify exploitation of other dangling COM registrations and can also be applied to buggy custom COM unmarshalers. Article: https://projectzero.google/2026/09/windows-dangling-com.html PoC: https://project-zero.issues.chromium.org/issues/538151139 CVE-2026-50343 — PT-2026-58331: https://dbu.gs/vulnerability/PT-2026-58331 CVE-2026-66804 — PT-2026-70703: https://dbu.gs/vulnerability/PT-2026-70703
Post summary
The text provides a deep technical analysis of CVE-2026-66804, a Windows LPE caused by a dangling COM registration, and confirms that a fully functional exploit has been published by Google Project Zero researcher James Forshaw.
130212776
3.7K followersView on X
Rıdvan Yağlı@ridvanyagli83d
PoC
🔴 Siber güvenlik şirketi @calif_io, Windows 11'i etkileyen "Dark Elevator" (CVE-2026-50343) adlı yeni bir Local Privilege Escalation (LPE) açığı yayınladı. Açık, InstallService bileşenindeki iki mantık hatasının zincirlenmesiyle düşük yetkili bir kullanıcının NT AUTHORITY\SYSTEM yetkileri elde etmesine olanak tanıyor. Bu açığın dikkat çeken yönü ise kernel belleğini bozma, UAC onayı, yönetici yetkisi, yeniden başlatma veya servis kontrol izinleri gerektirmeden güvenilir şekilde çalışabilmesi. İstismar başarılı olursa saldırgan; SYSTEM yetkileri elde edebiliyor, Kalıcılık sağlayabiliyor, Yeni ayrıcalıklı hesaplar oluşturabiliyor, Güvenlik mekanizmalarını devre dışı bırakabiliyor, Diğer kullanıcıların verilerine erişebiliyor. Bu açık 14/07/2026 tarihinde yamalandı. Mutlaka sisteminizi güncelleyin. PoC: https://github.com/califio/publications/tree/main/MADBugs/windows-CVE-2026-50343
Post summary
The tweet announces the Windows 11 CVE‑2026‑50343 LPE vulnerability, shares a PoC repository, details the exploit vector, and notes it was patched on 14 Jul 2026, urging users to update.
00061549
2.3K followersView on X
Rıdvan Yağlı@ridvanyagli89d
PoC
CVE-2026-50343 için PoC yayınlandı. Microsoft Install Service'deki bu yerel yetki yükseltme (EoP) açığı, düşük yetkili bir kullanıcının SYSTEM yetkisi kazanmasına olanak sağlayabiliyor. https://github.com/Rat5ak/CVE-2026-50343-InstallService-EoP
Post summary
A PoC for CVE-2026-50343, a local privilege‑escalation flaw in Microsoft Install Service, has been released on GitHub, showing how low‑privileged users can elevate to SYSTEM.
01032571
2.2K followersView on X
moton@moton70d
PoC
PoC Released for CVE-2026-50343 Windows SYSTEM Flaw - https://securityonline.info/cve-2026-50343-privilege-escalation/
Post summary
A Proof of Concept has been released for CVE-2026-50343, indicating that the vulnerability details and exploitation code are publicly available.
0001175
718 followersView on X
Jonas Vestberg@bugch3ck83d
General
@filip_dragovic CVE-2026-50343?
Post summary
The tweet simply poses a question about CVE-2026-50343, with no additional context or details.
00020399
1.9K followersView on X
セキュリティ対策Lab@securityLab_jp69d
PoC
Windows InstallServiceの権限昇格脆弱性(CVE-2026-50343)にPoC公開、SYSTEM権限取得の恐れ https://rocket-boys.co.jp/security-measures-lab/cve-2026-50343-windows-installservice-privilege-escalation/ #セキュリティ対策Lab #security #securitynews #脆弱性
Post summary
A proof‑of‑concept demonstrating a privilege escalation vulnerability (CVE‑2026‑50343) that could grant SYSTEM privileges has been published; no evidence of active exploitation or patches is provided.
00001213
513 followersView on X
SecureChap@SecureChap83d
Exploit
A standard user reaches NT AUTHORITY\SYSTEM on Windows 11 by hijacking InstallService plugin loading. CVE-2026-50343 covers the flaw in the SYSTEM svchost service behind the app install pipeline. Reported to Microsoft on 2026-05-20 by r0keb, fixed 2026-07-14. Affected builds include 10.0.26200.8457. Two root causes line up. StaticPluginMap entries under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State map plugin IDs to CLSIDs and are writable by any user. The CrossDevice COM class (CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}) registers its InprocServer32 DLL at %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll, a path standard users control. The sequence is direct. An attacker adds a StaticPluginMap value pointing any plugin ID at the CrossDevice CLSID, drops a malicious DLL that implements IInstallServicePlugin at the ProgramData path, then triggers InstallService. PluginHelpers::ActivatePlugin calls CoCreateInstance with CLSCTX_INPROC_SERVER, loading the DLL into the SYSTEM process. No memory corruption or timing windows are required. PoC is on GitHub. A user-writable registry map and a user-writable COM server registration together decide which code runs inside a SYSTEM service.
Post summary
A privileged escalation flaw on Windows 11 allows a standard user to gain SYSTEM rights by hijacking the InstallService plugin mechanism, with a PoC on GitHub and a vendor patch released in July 2026.
01000228
163 followersView on X
YACTINA@yactina133683d
Disclosure
Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343) https://blog.calif.io/p/dark-elevator-windows-install-service
Post summary
The text briefly announces CVE-2026-50343, a local privilege escalation flaw in the Windows Install Service, and directs readers to a blog post for more information.
0000149
20 followersView on X
nad@Nadsec1190d
PoC
@ptdbugs ;) https://github.com/Rat5ak/CVE-2026-50343-InstallService-EoP
Post summary
The tweet points to a GitHub repo containing a Proof of Concept for CVE-2026-50343, with no further exploit details or mitigation information.
0100024
583 followersView on X
Default RED@defaultredhq21d
Disclosure
James Forshaw at Project Zero details CVE-2026-66804, a Windows privilege escalation bug that is an incomplete fix for CVE-2026-50343, dubbed Dark Elevator by Calif. Forshaw and 14 others reported the issue.
Post summary
The text is a disclosure-style summary describing a new Windows privilege escalation vulnerability reported by Project Zero and researchers. It provides vulnerability details but lacks indicators of PoC, exploitability, active attacks, or patching guidance.
0000027
6 followersView on X

CPE platform detail17 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

17 of 17 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_10_1809	-	-	x64
OS	microsoft	windows_10_1809	-	-	x86
OS	microsoft	windows_10_21h2	-	-	arm64
OS	microsoft	windows_10_21h2	-	-	x64
OS	microsoft	windows_10_21h2	-	-	x86
OS	microsoft	windows_10_22h2	-	-	arm64
OS	microsoft	windows_10_22h2	-	-	x64
OS	microsoft	windows_10_22h2	-	-	x86
OS	microsoft	windows_11_24h2	-	-	arm64
OS	microsoft	windows_11_24h2	-	-	x64
OS	microsoft	windows_11_25h2	-	-	arm64
OS	microsoft	windows_11_25h2	-	-	x64
OS	microsoft	windows_11_26h1	-	-	arm64
OS	microsoft	windows_11_26h1	-	-	x64
OS	microsoft	windows_server_2019	-	-	-
OS	microsoft	windows_server_2022	-	-	-
OS	microsoft	windows_server_2025	-	-	-

Explore more

Back to dashboard microsoft CVEs windows_10_1809 vulnerabilities

What researchers are saying

CVE-2026-50343

Calif[verified]@calif_ioDisclosure

The tweet announces CVE‑2026‑50343, highlighting a reliable LPE path on Windows 11, and links to a detailed write-up, but does not provide PoC code, patch info, or evidence of active exploitation.

nad[verified]@Nadsec11PoC

A write‑up and proof‑of‑concept for CVE‑2026‑50343, a Windows local privilege‑elevation flaw, are posted on GitHub, with no evidence of active exploitation or available patch.

Casey[verified]@_subTeePoC

The tweet references a blog that appears to contain a PoC for CVE‑2026‑50343, describing a privilege‑escalation technique involving dropping a malicious DLL into a writable directory, but offers no evidence of active exploitation, patches, or detailed technical specifics.

blackorbird[verified]@blackorbirdPatch

The post describes a Windows local privilege-escalation vulnerability involving a dangling COM registration and notes that Microsoft has issued a fix, while also detailing the vulnerability's mechanics and providing a detection script.

hackyboiz[verified]@hackyboiz2Disclosure

The tweet discloses CVE‑2026‑50343 (Dark Elevator), a Windows InstallService LPE where a standard user can load a malicious DLL through a COM class and CrossDevice DLL path to achieve SYSTEM privileges.

Clandestine[verified]@akaclandestinePoC

The link points to a GitHub repository containing a proof‑of‑concept for CVE‑2026‑50343, with exploit code and technical details, but no evidence of active exploitation or patch information.

dbugs[verified]@ptdbugsExploit

The text provides a deep technical analysis of CVE-2026-66804, a Windows LPE caused by a dangling COM registration, and confirms that a fully functional exploit has been published by Google Project Zero researcher James Forshaw.

Rıdvan Yağlı[verified]@ridvanyagliPoC

The tweet announces the Windows 11 CVE‑2026‑50343 LPE vulnerability, shares a PoC repository, details the exploit vector, and notes it was patched on 14 Jul 2026, urging users to update.