VulnSocial

CVE-2026-50502PoC(microsoft / windows_10_1607)

MEDIUMCVSS 8.8 · HIGH

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Patch microsoft windows_10_1607 systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network.

microsoft CVEsBack to dashboard
4.5/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-1220

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

RISING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • windows_10_1607
  • windows_10_1809
  • windows_10_21h2
  • windows_10_22h2

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 11 mentions across 6 observed days
  • Momentum state: rising

What's happening

  • Exploit tool or code specified in 4 signals
  • PoC mentioned or linked in 8 signals
  • Patch or workaround mentioned in 7 signals
  • Technical details provided in 7 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 3 mentions (2026-07-30); latest day: 2
  • 11 total mentions across 6 days

Affected systems

Vendors
microsoft
Products
windows_10_1607windows_10_1809windows_10_21h2windows_10_22h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2012windows_server_2016windows_server_2019

2 versions affected across 12 products

Deep dive

Activity timeline11 mentions / 6d
01223Mentions · 2026-07-15: 2Mentions · 2026-07-21: 1Mentions · 2026-07-27: 1Mentions · 2026-07-29: 2Mentions · 2026-07-30: 3Mentions · 2026-07-31: 2PoC Mentioned / Linked · 2026-07-27: 1PoC Mentioned / Linked · 2026-07-29: 2PoC Mentioned / Linked · 2026-07-30: 3PoC Mentioned / Linked · 2026-07-31: 2Exploit Tool / Code · 2026-07-27: 1Exploit Tool / Code · 2026-07-29: 2Exploit Tool / Code · 2026-07-30: 1Patch / Workaround · 2026-07-15: 2Patch / Workaround · 2026-07-21: 1Patch / Workaround · 2026-07-27: 1Patch / Workaround · 2026-07-29: 1Patch / Workaround · 2026-07-30: 1Patch / Workaround · 2026-07-31: 1Technical Details · 2026-07-15: 1Technical Details · 2026-07-21: 1Technical Details · 2026-07-27: 1Technical Details · 2026-07-29: 2Technical Details · 2026-07-30: 207-1507-2107-2707-2907-3007-31
Signal classification3 categories
PoC
654.5%
Patch
327.3%
Disclosure
218.2%
Referenced assets10 URLs
By indicator
Classification over time
DateTotalLabels
2026-07-152
Disclosure1Patch1
2026-07-211
Patch1
2026-07-271
Patch1
2026-07-292
PoC2
2026-07-303
Disclosure1PoC2
2026-07-312
PoC2
Full discourse11 posts
  • moton@moton
    PoC

    CVE-2026-50502: PoC Exploit Public for Event Log RCE - https://securityonline.info/cve-2026-50502-windows-event-log-rce/

    Post summary

    A public Proof of Concept exploit for CVE-2026-50502, an Event Log Remote Code Execution vulnerability, is made available via the provided link, but no evidence of active exploitation or patches is offered.

    13911688714.0K
    756 followersView on X
  • Bad_Jubies@Bad_Jubies
    Disclosure

    My first set of Microsoft vulnerabilities have been published in this month’s patch Tuesday 🥳 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50502 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49162 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50466 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50469

    Post summary

    The post announces four Microsoft CVEs (CVE‑2026‑50502, CVE‑2026‑49162, CVE‑2026‑50466, CVE‑2026‑50469) released this month’s Patch Tuesday, linking to their Microsoft update guide pages.

    2212683.1K
    436 followersView on X
  • Login Sécurité@LoginSecurite
    Patch

    Microsoft : "on a bien patché la CVE-2025-29969" @HackAndDo : "hold my beer" Microsoft : "😮" Pour les détails, c'est sur le blog de Login Sécurité : https://login-securite.com/blog/cve-2026-50502-rce-via-le-service-windows-event-log-elfrbackupelfw

    Post summary

    Microsoft announced a patch for CVE-2025-29969, while a blog post supplies technical details on a different CVE-2026-50502 that involves RCE via the Windows Event Log service.

    0411173.4K
    556 followersView on X
  • kokumօtօ@__kokumoto
    PoC

    Windowsイベントログの遠隔コード実行脆弱性CVE-2026-50502に対応するPoC（攻撃の概念実証コード）が公開された。7月の定例更新で修正されていたもので、CVSSスコア8.0。名前付きパイプ\pipe\eventlogから到達可能なMS-EVEN RPCが脆弱。CVE-2025-29969の修正不足。 https://securityonline.info/cve-2026-50502-windows-event-log-rce/

    Post summary

    A proof‑of‑concept code for the Windows event‑log RCE (CVE‑2026‑50502) has been published, with technical details and a July patch update noted.

    01071788
    7.8K followersView on X
  • SuperfluousSecurity@SuperfluousSec
    Disclosure

    Poor windows 10 https://securityonline.info/cve-2026-50502-windows-event-log-rce/ https://login-securite.com/blog/cve-2026-50502-rce-via-le-service-windows-event-log-elfrbackupelfw

    Post summary

    The text provides links to external articles announcing and detailing CVE‑2026‑50502, a Windows Event Log RCE vulnerability, but offers no further analysis or evidence of exploitation.

    01021393
    696 followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    Microsoft has patched a critical Windows Event Logging vulnerability (CVE-2026-50502) allowing remote code execution. Update your systems immediately. #Microsoft #Vulnerability #CyberSecurity #WindowsServer #CVE202650502 http://meterpreter.org/windows-event-logging-vulnerability/

    Post summary

    Microsoft has issued a patch for CVE‑2026‑50502, a critical remote code execution flaw in Windows Event Logging; users are urged to update promptly.

    01012380
    12.6K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    PoC

    A public PoC exploit now targets CVE-2026-50502, an RCE in the Windows Event Log service. Microsoft patched the flaw on July 14, 2026. Details below. #CVE202650502 #WindowsEventLog #RCE #PatchTuesday #InfoSec #Microsoft http://securityonline.info/cve-2026-50502-windows-event-log-rce/

    Post summary

    A public PoC for CVE-2026-50502, a Windows Event Log RCE, is available, and Microsoft has patched it.

    00011403
    12.6K followersView on X
  • キタきつね@foxbook
    PoC

    CVE-2026-50502: 公開された概念実証（PoC）エクスプロイトの詳細 Windowsイベントログのリモートコード実行 CVE-2026-50502: Public PoC Exploit Details Windows Event Log Remote Code Execution #DailyCyberSecurity (Jul 29) https://securityonline.info/cve-2026-50502-windows-event-log-rce/

    Post summary

    The post announces a publicly available PoC for CVE‑2026‑50502, detailing a remote code execution vulnerability via Windows Event Log, without mentioning active exploitation, exploitation code, or a patch.

    00001255
    4.9K followersView on X
  • セキュリティ・トレンド bot だった@sec_trend
    PoC

    WindowsイベントログサービスのRPCインターフェースで脆弱性(CVE-2026-50502) https://rocket-boys.co.jp/security-measures-lab/windows-eventlog-cve-2026-50502-poc-2026/

    Post summary

    The post announces CVE-2026-50502 for Windows Event Log RPC and points to a URL containing a PoC, but provides no exploit details, active use evidence, patches, or technical specifics.

    0000091
    2.0K followersView on X
  • セキュリティ対策Lab@securityLab_jp
    PoC

    WindowsイベントログサービスのRPCインターフェースで脆弱性(CVE-2026-50502)、修正済みのCVE-2025-29969検証ロジックの盲点を突くPoCが公開 https://rocket-boys.co.jp/security-measures-lab/windows-eventlog-cve-2026-50502-poc-2026/ #セキュリティ対策Lab #security #securitynews #脆弱性

    Post summary

    A Proof of Concept for CVE-2026-50502 affecting the Windows Event Log RPC interface has been published, exposing a flaw in the patched logic for CVE-2025-29969.

    00000181
    509 followersView on X
  • Windows Forum@windowsforum
    Patch

    🪟 Windows Event Log can become a remote-code-execution launchpad. Patch CVE-2026-50502 by July 14—because “just logging” shouldn’t mean handing attackers the keys. https://windowsforum.com/threads/cve-2026-50502-patch-windows-event-log-rce-by-july-14.438567/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity #RemoteCodeExecution #PatchTuesday #Cve202650502 https://t.co/eIy5EuDWnh

    Post summary

    The message urges users to apply the CVE-2026-50502 patch by July 14 to prevent a remote code execution vulnerability in Windows Event Log.

    0000036
    1.2K followersView on X
CPE platform detail22 entries

22 of 22 entries

PartVendorProductVersionTarget SWTarget HW
OSmicrosoftwindows_10_1607--x64
OSmicrosoftwindows_10_1607--x86
OSmicrosoftwindows_10_1809--x64
OSmicrosoftwindows_10_1809--x86
OSmicrosoftwindows_10_21h2--arm64
OSmicrosoftwindows_10_21h2--x64
OSmicrosoftwindows_10_21h2--x86
OSmicrosoftwindows_10_22h2--arm64
OSmicrosoftwindows_10_22h2--x64
OSmicrosoftwindows_10_22h2--x86
OSmicrosoftwindows_11_24h2--arm64
OSmicrosoftwindows_11_24h2--x64
OSmicrosoftwindows_11_25h2--arm64
OSmicrosoftwindows_11_25h2--x64
OSmicrosoftwindows_11_26h1--arm64
OSmicrosoftwindows_11_26h1--x64
OSmicrosoftwindows_server_2012---
OSmicrosoftwindows_server_2012r2--
OSmicrosoftwindows_server_2016---
OSmicrosoftwindows_server_2019---
OSmicrosoftwindows_server_2022---
OSmicrosoftwindows_server_2025---

Explore more

Back to dashboardmicrosoft CVEswindows_10_1607 vulnerabilities