CVE-2026-50454PoC(microsoft / windows_11_24h2)

MEDIUMCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch microsoft windows_11_24h2 systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

microsoft CVEs Back to dashboard

4.5/ 10 priority

Sources & remediation

Patch / fix

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50454

Weakness type (CWE)

CWE-23

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2025

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
8 mentions across 6 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 4 signals
PoC mentioned or linked in 7 signals
Patch or workaround mentioned in 1 signal
Technical details provided in 7 signals
Peaked 4d ago at 2 mentions (2026-07-17); latest day: 1
8 total mentions across 6 days

Affected systems

Vendors

microsoft

Products

windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2025

Deep dive

Activity timeline8 mentions / 6d

Signal classification2 categories

PoC

787.5%

Patch

112.5%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	1	Patch1
2026-07-17	2	PoC2
2026-07-20	1	PoC1
2026-07-24	2	PoC2
2026-07-27	1	PoC1
2026-09-13	1	PoC1

Full discourse8 posts

/r/netsec@_r_netsec92d
PoC
Windows AppResolver LPE: From AppContainer to SYSTEM. PoC linked to CVE-2026-50454 https://davidcarliez.github.io/blog/windows-appresolver-lpe-to-system/
Post summary
A proof‑of‑concept for the Windows AppResolver local privilege escalation (CVE‑2026‑50454) is shared, but no active exploitation or patch information is present.
116060413.9K
33.7K followersView on X
Nicolas Krassas@Dinosn92d
PoC
Windows AppResolver LPE: From AppContainer to SYSTEM. PoC linked to CVE-2026-50454 https://davidcarliez.github.io/blog/windows-appresolver-lpe-to-system/
Post summary
The post announces a proof‑of‑concept for a Windows AppResolver LPE flaw (CVE‑2026‑50454) and provides a direct link to the PoC code.
013043153.5K
160.8K followersView on X
Daily CyberSecurity@Daily_CyberSec85d
PoC
A public proof-of-concept details the Windows AppResolver LPE (CVE-2026-50454), a UAC bypass that chains an admin token to a SYSTEM shell. #Windows #CVE202650454 #PrivilegeEscalation #UACBypass #InfoSec http://securityonline.info/windows-appresolver-lpe-cve-2026-50454/
Post summary
The post announces a publicly available proof‑of‑concept for CVE‑2026‑50454, a Windows AppResolver local privilege escalation that bypasses UAC by inheriting an admin token to a SYSTEM shell.
014044122.1K
12.9K followersView on X
/r/netsec@_r_netsec34d
PoC
Windows AppResolver LPE: From AppContainer to SYSTEM. PoC linked to CVE-2026-50454 https://davidcarliez.github.io/blog/windows-appresolver-lpe-to-system/
Post summary
The post announces a PoC for a Windows AppResolver LPE (CVE-2026-50454) that escalates from AppContainer to SYSTEM, with no indication of active exploitation or patch availability.
0301151.5K
34.3K followersView on X
dbugs@ptdbugs89d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-50454 PT ID: PT-2026-58431 Vendor: Microsoft Product: Windows 11 Version 24H2 Description: Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-58431 • https://github.com/DavidCarliez/Windows-AppResolver-LPE-PoC #dbugs_vuln
Post summary
A proof‑of‑concept and exploitable code for CVE‑2026‑50454, which allows local privilege escalation via relative path traversal in Windows 11 24H2, has been released on GitHub, but no active exploitation or patch information is provided.
010153858
3.4K followersView on X
キタきつね@foxbook83d
PoC
CVE-2026-50454: 公開された概念実証により、Windows AppResolver による SYSTEM 権限への昇格が示される CVE-2026-50454: Public PoC Shows Windows AppResolver Elevation of Privilege to SYSTEM #DailyCyberSecurity (Jul 24) https://securityonline.info/windows-appresolver-lpe-cve-2026-50454/
Post summary
A proof‑of‑concept demonstrating an elevation of privilege via Windows AppResolver for CVE‑2026‑50454 has been released, with details linked, but no active exploitation, patches, or exploitation code are reported.
00020385
5.0K followersView on X
moton@moton85d
PoC
CVE-2026-50454: Windows AppResolver LPE PoC Public - https://securityonline.info/windows-appresolver-lpe-cve-2026-50454/
Post summary
The post shares a public PoC for the Windows AppResolver Local Privilege Escalation vulnerability CVE‑2026‑50454, but does not indicate active exploitation, patches, or false positive status.
0001188
705 followersView on X
Windows Forum@windowsforum94d
Patch
🪟 Windows 11’s UI Core had a privilege-escalation hole, because apparently “local user” needed a promotion. Install KB5101650 before your PC hands out admin rights for free. https://windowsforum.com/threads/cve-2026-50454-install-kb5101650-to-fix-windows-11-elevation-flaw.438491/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity #PrivilegeEscalation #MicrosoftPatching #Cve202650454 https://t.co/HkbfoQpoxT
Post summary
The post alerts readers to a Windows 11 privilege‑escalation flaw (CVE‑2026‑50454) and urges applying the KB5101650 patch to prevent unintentional admin privilege gain.
0000052
1.2K followersView on X

CPE platform detail7 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

7 of 7 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_11_24h2	-	-	arm64
OS	microsoft	windows_11_24h2	-	-	x64
OS	microsoft	windows_11_25h2	-	-	arm64
OS	microsoft	windows_11_25h2	-	-	x64
OS	microsoft	windows_11_26h1	-	-	arm64
OS	microsoft	windows_11_26h1	-	-	x64
OS	microsoft	windows_server_2025	-	-	-

Explore more

Back to dashboard microsoft CVEs windows_11_24h2 vulnerabilities

What researchers are saying

CVE-2026-50454

Nicolas Krassas[verified]@DinosnPoC

The post announces a proof‑of‑concept for a Windows AppResolver LPE flaw (CVE‑2026‑50454) and provides a direct link to the PoC code.

dbugs[verified]@ptdbugsPoC

A proof‑of‑concept and exploitable code for CVE‑2026‑50454, which allows local privilege escalation via relative path traversal in Windows 11 24H2, has been released on GitHub, but no active exploitation or patch information is provided.

キタきつね[verified]@foxbookPoC

A proof‑of‑concept demonstrating an elevation of privilege via Windows AppResolver for CVE‑2026‑50454 has been released, with details linked, but no active exploitation, patches, or exploitation code are reported.

Windows Forum[verified]@windowsforumPatch

The post alerts readers to a Windows 11 privilege‑escalation flaw (CVE‑2026‑50454) and urges applying the KB5101650 patch to prevent unintentional admin privilege gain.

/r/netsec@_r_netsecPoC

A proof‑of‑concept for the Windows AppResolver local privilege escalation (CVE‑2026‑50454) is shared, but no active exploitation or patch information is present.

Daily CyberSecurity@Daily_CyberSecPoC

The post announces a publicly available proof‑of‑concept for CVE‑2026‑50454, a Windows AppResolver local privilege escalation that bypasses UAC by inheriting an admin token to a SYSTEM shell.

/r/netsec@_r_netsecPoC

The post announces a PoC for a Windows AppResolver LPE (CVE-2026-50454) that escalates from AppContainer to SYSTEM, with no indication of active exploitation or patch availability.

moton@motonPoC

The post shares a public PoC for the Windows AppResolver Local Privilege Escalation vulnerability CVE‑2026‑50454, but does not indicate active exploitation, patches, or false positive status.