Improper link resolution before file access

CVE-2026-50469 is a CWE-59 (symlink / link-following) elevation-of-privilege flaw in the Windows Projected File System (prjflt.sys minifilter driver). A local, low-privileged attacker can craft NTFS junctions or symbolic links that redirect privileged file operations performed by the ProjFS driver into attacker-controlled locations, ultimately escalating to SYSTEM. Affected platforms span Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, Windows Server 2019 and Server 2025. The fix shipped in the July 2026 Patch Tuesday cumulative updates (e.g. KB5101649 for Windows 11 26H1).

Microsoft rated this Important / 7.8, which is the standard CVSS bucket for a local low-priv-to-SYSTEM EoP. That score is technically accurate if ProjFS is running — but it overstates the real-world risk because ProjFS is an *optional Windows component* that ships disabled by default. It must be explicitly enabled via Enable-WindowsOptionalFeature -FeatureName Client-ProjFS. Outside of VFS for Git, Scalar monorepo tooling, and a handful of niche cloud-sync providers, most enterprise endpoints never turn it on. The vendor score prices in zero friction for feature adoption, and that is where it misleads defenders.

Why this verdict

• Optional-feature gate eliminates most of the fleet. ProjFS (Client-ProjFS) ships disabled by default on every Windows SKU. Only hosts that have explicitly enabled it — primarily developer workstations running VFS for Git or Scalar — are exposed. In a 10,000-host fleet, this is likely 200–500 machines at most.
• Local access is a hard prerequisite. CVSS AV:L means the attacker must already have code execution on the target. This is a post-initial-access privilege escalation primitive, not an entry vector. The chain assumes a prior compromise stage.
• No PoC, no ITW, bottom-quartile EPSS. There is no public exploit code, no campaign activity, no KEV listing, and EPSS sits at 0.27%. Near-term weaponization risk is low.
• Role multiplier: ProjFS is overwhelmingly deployed on *developer workstations* (low-to-medium value). Build servers running VFS for Git could represent a supply-chain-relevant high-value role, but (a) Scalar has largely replaced VFS for Git in new deployments, (b) most CI/CD uses standard git clone without ProjFS, and (c) the population of ProjFS-enabled build servers is well below 1% of all ProjFS installs. The high-value-role floor does NOT trigger because the affected component is not canonically a high-value-role component and high-value deployments are far below the 1% threshold.

Why not higher?

To reach HIGH, the vulnerability would need either a broader exposed population, active exploitation, or a canonical high-value deployment role. ProjFS fails all three tests: it is an opt-in feature on <5% of endpoints, has no exploitation activity, and its primary habitat is developer workstations — not domain controllers, identity providers, hypervisors, or network edge devices. The build-server supply-chain scenario is theoretically possible but practically negligible (<1% of ProjFS installs).

Why not lower?

When ProjFS *is* enabled, the chain is straightforward — low complexity, no user interaction, standard-user to SYSTEM. CWE-59 symlink EoP is a well-researched class with known tooling patterns, and ProjFS has seen a steady cadence of EoP CVEs throughout 2025–2026, suggesting ongoing researcher attention. A LOW rating would understate the impact on the subset of hosts that are actually exposed.

1. Disable ProjFS on hosts that don't need it — Run Disable-WindowsOptionalFeature -Online -FeatureName Client-ProjFS on endpoints where VFS for Git / Scalar / custom providers are not in use. This completely eliminates the attack surface with zero operational cost. Audit enablement fleet-wide via SCCM/Intune configuration baselines. No mitigation SLA applies at MEDIUM — go straight to the 365-day remediation window.
2. Inventory ProjFS-enabled hosts — Query Get-WindowsOptionalFeature -Online -FeatureName Client-ProjFS across your fleet via your endpoint management tool to identify the actual exposed population. Prioritize patching this subset within your 365-day remediation window.
3. Harden developer workstations with WDAC or AppLocker — Application control policies prevent an attacker from dropping and executing arbitrary binaries even after achieving SYSTEM, blunting the post-exploitation impact of this and similar local EoP chains.
4. Monitor for symlink/junction creation in ProjFS directories — Deploy Sysmon with FileCreate (Event ID 11) rules that alert on reparse-point creation in known ProjFS virtualization roots (typically under VFS for Git working directories). This provides detective coverage while awaiting the patch.

Run this script on each target Windows host with standard user privileges (no elevation needed for the feature query; elevation needed for hotfix check). Example: .\Check-CVE-2026-50469.ps1 in a PowerShell console. Deploy fleet-wide via Intune, SCCM, or your RMM.

#Requires -Version 5.1
<#
  Check-CVE-2026-50469.ps1
  Checks whether the host is vulnerable to CVE-2026-50469
  (ProjFS symlink EoP, July 2026 Patch Tuesday)
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'

try {
    # Step 1: Check if ProjFS feature is enabled
    $projfs = Get-WindowsOptionalFeature -Online -FeatureName 'Client-ProjFS' 2>$null
    if (-not $projfs -or $projfs.State -ne 'Enabled') {
        Write-Output 'PATCHED - ProjFS feature is not enabled on this host. Not vulnerable.'
        exit 0
    }

    Write-Output '[!] ProjFS (Client-ProjFS) is ENABLED on this host.'

    # Step 2: Check for July 2026 cumulative update
    # Known KBs for the July 2026 Patch Tuesday fix:
    $patchKBs = @('KB5101649','KB5101638','KB5101632','KB5101625','KB5099539','KB5101636')
    $installedHotfixes = Get-HotFix 2>$null | Select-Object -ExpandProperty HotFixID

    $patched = $false
    foreach ($kb in $patchKBs) {
        if ($installedHotfixes -contains $kb) {
            Write-Output "PATCHED - July 2026 update $kb is installed."
            $patched = $true
            break
        }
    }

    if (-not $patched) {
        # Fallback: check prjflt.sys file version
        $driverPath = "$env:SystemRoot\System32\drivers\prjflt.sys"
        if (Test-Path $driverPath) {
            $ver = (Get-Item $driverPath).VersionInfo.FileVersion
            Write-Output "[i] prjflt.sys version: $ver"
        }
        Write-Output 'VULNERABLE - ProjFS is enabled and July 2026 cumulative update is NOT installed.'
        exit 1
    }
    exit 0
}
catch {
    Write-Output "UNKNOWN - Error during check: $_"
    exit 2
}

Sources

1. MSRC Advisory — CVE-2026-50469
2. Microsoft — Enabling Windows Projected File System
3. Huntress — Windows ProjFS Internals: A Technical Deep Dive
4. Tenable — KB5101649 Nessus Plugin (Windows 11 26H1)
5. Tenable — July 2026 Patch Tuesday Overview
6. ZDI — Symlink Privilege Escalation Techniques on Windows
7. FIRST — EPSS Data and Statistics