CVE-2026-50454 · Windows User Interface Core AppResolver Local Privilege Escalation

01 · The Real Story

The bouncer checks your face but not your fake VIP wristband, so you walk straight into the back office

CVE-2026-50454 is a local privilege-escalation flaw in Windows.UI.Storage.dll, the DLL backing the Windows AppResolver subsystem. On unpatched builds of Windows 11 24H2 / 25H2 / 26H1 and Windows Server 2025, a zero-capability AppContainer process can call the private AppResolverActivationArgsFactory COM interface without any capability check. An attacker abuses this to register a malicious ProgID as the default ms-settings protocol handler via SetAsDefault, then launches fodhelper.exe — a Microsoft-signed binary that auto-elevates without a UAC consent prompt. The handler fires with a High-integrity administrator token, from which the attacker creates a temporary Windows service to obtain an interactive NT AUTHORITY\SYSTEM shell. Affected builds are Windows.UI.Storage.dll versions below 10.0.26100.8875 (24H2 / Server 2025), 10.0.26200.8875 (25H2), and 10.0.28000.2269 (26H1). Fixed in the July 14 2026 Patch Tuesday cumulative updates KB5101649, KB5101650, KB5095051, and KB5099536.

Microsoft rates this Important / 7.8 HIGH with an Exploitability Index of "Exploitation More Likely." That label is reasonable but slightly generous. The CVSS vector claims PR:L (low privileges), yet the only public PoC — released by David Carliez on July 24 — explicitly starts from a filtered local-administrator session, not a standard user account. The fodhelper auto-elevation chain fundamentally requires Administrators-group membership; a true standard user cannot complete it. The real-world prerequisite is therefore closer to PR:H than PR:L, which Microsoft's own score does not reflect. At the same time, the technique pattern (fodhelper.exe + ms-settings handler hijack) is one of the best-documented UAC bypass families, and mature EDR platforms carry prebuilt behavioral detections for it. We downgrade the score from 7.8 to 7.0 but hold the severity bucket at HIGH because of the blast-radius floor on domain controllers and Hyper-V hosts running Server 2025.

"UAC bypass via AppResolver gives filtered admins a SYSTEM shell — real but narrow post-compromise step"

02 · The Attack Path

5 steps from start to impact.

STEP 01

Establish local admin foothold

The attacker already holds credentials for an account in the local Administrators group on the target Windows 11 or Server 2025 host. The session runs at Medium integrity because UAC filters the token. This is a post-initial-access prerequisite — the attacker is already inside the network and has elevated to local admin on the endpoint through credential theft, lateral movement, or social engineering.

Conditions required:

Local Administrators group membership
Interactive (console / RDP) session on a vulnerable build

Where this breaks in practice:

Requires prior compromise — attacker must already be local admin
Interactive session required; cannot be triggered purely over SMB/WinRM in default config

Detection/coverage: Logon auditing (Event IDs 4624 type 2/10), EDR session-tracking, RDP anomaly detection

STEP 02

Spawn zero-capability AppContainer

The attacker's tool creates an AppContainer process with zero declared capabilities. On vulnerable builds, Windows.UI.Storage.dll does not enforce capability checks (applicationDefaults or shellExperience) before allowing the AppContainer to instantiate AppResolverActivationArgsFactory. This is the root-cause path-traversal / authorization-bypass bug.

Conditions required:

Unpatched Windows.UI.Storage.dll on the host

Where this breaks in practice:

None on a vulnerable build — the missing check is unconditional

Detection/coverage: Sysmon Event ID 1 with AppContainer token attributes; anomalous zero-capability AppContainer creation is uncommon in normal workflows

STEP 03

Hijack ms-settings protocol handler

Via the unauthorized AppResolver factory, the attacker calls SetAsDefault to register a custom ProgID as the handler for the ms-settings: protocol. Windows creates a protected file-type association pointing to the attacker-controlled binary. This writes to HKCU\Software\Classes\ms-settings\Shell\Open\command — a user-writable registry hive. Weaponized tool: David Carliez's Windows-AppResolver-LPE-PoC automates this step.

Conditions required:

Step 2 succeeded (AppResolver factory instantiated)

Where this breaks in practice:

Registry modification to ms-settings handler is a well-known IoC; EDR and Sysmon rules exist

Detection/coverage: Elastic prebuilt rule 'UAC Bypass Attempt via Windows Directory Masquerading' and analogous CrowdStrike/SentinelOne behavioral alerts for ms-settings handler modification; Sysmon Event ID 13 registry value set

STEP 04

Trigger fodhelper auto-elevation

The attacker launches fodhelper.exe, a Microsoft-signed system binary with autoElevate=true in its manifest. Because the calling user is in the Administrators group, Windows auto-elevates fodhelper to High integrity without displaying a consent prompt. Fodhelper then attempts to open ms-settings:, which now resolves to the attacker's handler, executing it at High integrity.

Conditions required:

User is a member of local Administrators group
UAC auto-elevation is not disabled by policy

Where this breaks in practice:

fodhelper.exe child-process spawning is one of the most widely detected UAC bypass signatures in the EDR ecosystem (Elastic ships 26+ UAC bypass behavior protections)
Environments with ConsentPromptBehaviorAdmin=1 (prompt on secure desktop) block auto-elevation entirely

Detection/coverage: Process-tree anomaly: fodhelper.exe spawning unexpected child; MITRE ATT&CK T1548.002 coverage is mature across major EDR vendors

STEP 05

Escalate to SYSTEM via service creation

With a High-integrity administrator token, the attacker creates a temporary Windows service whose binPath points to a payload (e.g., cmd.exe /c). The SCM starts the service process as NT AUTHORITY\SYSTEM. The PoC opens an interactive SYSTEM shell. From SYSTEM, the attacker can dump credentials (LSASS, SAM, DPAPI), tamper with security agents, or — on a domain controller — extract NTDS.dit for full domain compromise.

Conditions required:

High-integrity admin token from step 4

Where this breaks in practice:

Service creation generates Event ID 7045 (System log) and is monitored by most SIEM deployments
EDR behavioral engines flag transient service creation patterns

Detection/coverage: Windows Event ID 7045 (new service installed), Sysmon Event ID 1 (service process), EDR service-creation behavioral alerts

03 · Compensating Control

HIGH 7.0→LOW 3.5

SEVERITY REDUCED

Force UAC to always prompt on secure desktop — Set Group Policy

Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

to Prompt for consent on the secure desktop (value 1). This breaks the auto-elevation that fodhelper.exe relies on, killing step 4 of the chain entirely. Deploy within 30 days per the noisgate mitigation SLA for HIGH severity.

HIGH 7.0→MEDIUM 5.0

SEVERITY REDUCED

Deploy or validate EDR coverage for T1548.002 — Confirm your EDR platform has active behavioral rules for UAC bypass via fodhelper.exe, ms-settings handler hijacking, and anomalous service creation. Elastic, CrowdStrike, SentinelOne, and Defender for Endpoint all ship prebuilt detections. Validate with a controlled test (the PoC itself, in a sandbox) to confirm your EDR blocks or alerts. Deploy within 30 days per the noisgate mitigation SLA.

HIGH 7.0→LOW 2.5

SEVERITY REDUCED

Restrict local Administrators group membership — Enforce least-privilege: remove standard users from the local Administrators group via LAPS, Intune, or Group Policy Restricted Groups. If the attacker cannot obtain admin-group membership, the entire chain is blocked at step 1. This is a foundational hardening control that should already be in place. Deploy within 30 days.

HIGH 7.0→IGNORE 0.0

SEVERITY REDUCED

Apply July 2026 cumulative updates — Install KB5101649/KB5101650 (Win11), KB5095051 (Win11 26H1), or KB5099536 (Server 2025). This is the definitive remediation — Microsoft added capability checks for applicationDefaults/shellExperience before the AppResolver factory creates the object, rejecting zero-capability AppContainers with E_ACCESSDENIED. Deploy within 180 days per the noisgate remediation SLA for HIGH severity.

What doesn't work

Application whitelisting / WDAC alone — fodhelper.exe is a Microsoft-signed, trusted Windows binary; it will pass any allowlist. The bypass works precisely because it abuses a trusted binary's auto-elevation behavior, not an unsigned payload.
Network segmentation / firewall rules — This is a purely local attack with no network component. Blocking ports or segmenting VLANs has zero impact on the exploit chain.
Credential Guard — While Credential Guard protects LSASS secrets post-exploitation, it does not prevent the privilege escalation itself. The attacker still reaches SYSTEM; they just cannot dump some credential types. The elevation and service-creation steps succeed regardless.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	No confirmed in-the-wild exploitation. Not listed in CISA KEV. No GreyNoise or Shadowserver sensor hits as of October 2026. Microsoft rates the Exploitability Index as Exploitation More Likely, indicating they believe weaponization is feasible.
Proof-of-Concept	Public PoC available. DavidCarliez/Windows-AppResolver-LPE-PoC — published ~July 24, 2026. Demonstrates filtered-admin → SYSTEM on Win11 build 26200.8737. Write-up by Do Son on SecurityOnline the same day. Not indexed on pocindex.io at time of assessment.
EPSS	0.37–0.44% (≈32nd percentile). Low predicted exploitation probability within 30 days, consistent with a local-only attack that requires prior admin access.
CISA KEV	Not listed. No binding operational directive applies.
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` — Local access, low complexity, low privileges required, no user interaction. The `PR:L` designation is contested: the only demonstrated chain requires local administrator membership, not merely a standard user.
Affected Versions	Windows 11 24H2 (< `10.0.26100.8875`), Windows 11 25H2 (< `10.0.26200.8875`), Windows 11 26H1 (< `10.0.28000.2269`), Windows Server 2025 (< `10.0.26100.33158`). Not affected: Windows 10, Windows 11 23H2 and earlier, Server 2019, Server 2022.
Fixed Versions	KB5101649 / KB5101650 (Win11 24H2/25H2), KB5095051 (Win11 26H1), KB5099536 (Server 2025) — all released July 14, 2026. No Linux/distro backport dimension; Windows-only.
Scanning / Exposure	Not network-exploitable. No Shodan/Censys/FOFA exposure surface — this is a local privilege escalation. Exposure is equal to the count of unpatched Win11 24H2+ and Server 2025 endpoints in your fleet.
Disclosure	Published July 14, 2026 as part of Microsoft Patch Tuesday (569–622 CVEs that month). PoC dropped July 24, 2026 — 10 days post-patch.
Researcher / Reporter	David Carliez (PoC author and likely reporter). Microsoft credits the vulnerability fix in the July 2026 cumulative update. Write-up amplified by Do Son at Daily CyberSecurity / SecurityOnline.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to HIGH (7.0/10)

Why this verdict

PoC overstates the privilege floor: The CVSS vector claims PR:L, but the only public exploit chain requires local Administrators-group membership (filtered by UAC). A standard user cannot complete the fodhelper auto-elevation step. The real prerequisite is closer to PR:H, which alone would drop the CVSS base to ~6.7.
Post-compromise positioning: The attacker must already hold local admin credentials and an interactive session on the target host. This is a mid-to-late-stage post-exploitation step, not an initial-access or remote vector. The compounding prerequisite of prior admin-level compromise significantly narrows the reachable population.
Mature detection surface: The fodhelper.exe UAC bypass (MITRE ATT&CK T1548.002) is among the best-covered techniques in the EDR ecosystem. Elastic ships 26+ prebuilt UAC bypass behavior protections; CrowdStrike, SentinelOne, and Defender for Endpoint all flag ms-settings handler hijacking and fodhelper child-process anomalies. Environments with deployed EDR will likely catch this before SYSTEM is reached.
Narrow OS scope: Only Windows 11 24H2+, 25H2, 26H1 and Server 2025 are affected. Windows 10 (still the dominant enterprise desktop OS as of mid-2026) and Server 2019/2022 are not vulnerable, limiting the blast radius to organizations that have aggressively adopted the newest OS versions.
Role multiplier — Domain Controllers (Server 2025): On a DC running Server 2025, filtered-admin → SYSTEM yields machine-account access to NTDS.dit, enabling full domain compromise. DCs represent >1% of Server 2025 installs, so the blast radius floor for this role is HIGH. However, the prerequisite — interactive local-admin session on a DC — already implies near-complete domain compromise in most environments, limiting the *incremental* severity.
Role multiplier — Hyper-V hosts (Server 2025): SYSTEM on a Hyper-V host can access VM configurations and virtual disks, but again requires prior local-admin interactive access. The incremental risk above what a filtered admin can already do (e.g., Hyper-V Manager, PowerShell Direct) is modest.
Role multiplier — Workstations (Windows 11): On enterprise workstations, filtered-admin → SYSTEM enables LSASS credential dumping and DPAPI key extraction, facilitating lateral movement. This is the most common deployment role and the most impactful practical scenario, but EDR coverage is strongest on managed endpoints.

Why not higher?

A CRITICAL rating would require either remote exploitability, standard-user exploitation, or active in-the-wild campaigns — none of which apply here. The chain demands local admin membership AND an interactive session, both of which represent significant prior compromise. The only demonstrated path is a UAC bypass variant, and UAC is explicitly *not a security boundary* per Microsoft's own security servicing criteria, which contextually limits the ceiling.

Why not lower?

A MEDIUM rating would understate the risk because a public weaponized PoC exists, Microsoft rates exploitation as "More Likely," and the blast radius on Server 2025 domain controllers reaches domain-takeover severity. The 10-day patch-to-PoC window means adversaries incorporating this into toolkits is plausible. The technique is also trivially chainable with any initial-access vector that lands a local admin shell, making it a reliable stage-2 component in real intrusion chains.

06 · Verification

Crowdsourced verification payload.

Run on each target Windows 11 or Server 2025 host as any user (no admin required for version check). Example: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-50454.ps1. Exit code 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN.

noisgate-verify.ps1

POWERSHELLREAD-ONLYSAFE

#Requires -Version 5.1
<#
.SYNOPSIS
  Checks whether the local system is vulnerable to CVE-2026-50454
  (Windows User Interface Core / AppResolver LPE).
.NOTES
  Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
#>
$ErrorActionPreference = 'Stop'

$dll = Join-Path $env:SystemRoot 'System32\Windows.UI.Storage.dll'

if (-not (Test-Path $dll)) {
    Write-Output 'UNKNOWN - Windows.UI.Storage.dll not found. System may not be affected (older OS or Server Core without Desktop Experience).'
    exit 2
}

try {
    $fi = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($dll)
    $fv = [version]('{0}.{1}.{2}.{3}' -f $fi.FileMajorPart, $fi.FileMinorPart, $fi.FileBuildPart, $fi.FilePrivatePart)
} catch {
    Write-Output "UNKNOWN - Could not read version info from $dll : $_"
    exit 2
}

# Fixed thresholds per OS build
$fixed = switch ($fv.Build) {
    26100 { [version]'10.0.26100.8875'  }   # Win11 24H2 / Server 2025
    26200 { [version]'10.0.26200.8875'  }   # Win11 25H2
    28000 { [version]'10.0.28000.2269'  }   # Win11 26H1
    default { $null }
}

if ($null -eq $fixed) {
    Write-Output "UNKNOWN - DLL build $($fv.Build) is not in the known affected range (26100, 26200, 28000). Likely not vulnerable."
    exit 2
}

if ($fv -ge $fixed) {
    Write-Output "PATCHED - Windows.UI.Storage.dll $fv >= $fixed. CVE-2026-50454 is remediated."
    exit 0
} else {
    Write-Output "VULNERABLE - Windows.UI.Storage.dll $fv < $fixed. CVE-2026-50454 is exploitable."
    exit 1
}