Insufficient granularity of access control in Windows Event Logging Service

CVE-2026-50502 is a remote code execution vulnerability in the Windows Event Logging Service (wevtsvc), caused by insufficient granularity of access control (CWE-1220). A low-privileged authenticated user can craft network requests to the service that bypass intended authorization checks, achieving code execution in the service's security context — which is NT AUTHORITY\SYSTEM. Every supported Windows version is affected: Windows 10 v1607 through Windows 11 24H2, and Windows Server 2016 through Server 2025. The service is non-optional and runs on every Windows host in your fleet, including domain controllers, Hyper-V hosts, and SIEM forwarders.

Microsoft rated this Important / HIGH at CVSS 8.0, which is directionally correct but slightly generous for current real-world risk. The CVSS vector includes both PR:L (authenticated) and UI:R (user interaction required) — a two-gate friction chain that substantially narrows the exploitable population compared to a typical unauthenticated RCE. There is no public PoC, no in-the-wild exploitation, and EPSS sits at just 0.6% — all indicators that weaponization has not occurred. The vendor severity is fair as a ceiling, but the practical urgency is lower than the raw score implies, which is why noisgate compresses this to HIGH 7.0.

Why this verdict

• Two-gate authentication + interaction barrier: PR:L requires the attacker to already possess valid credentials, and UI:R requires a user on the target host to interact with a malicious payload. Both gates must be cleared sequentially, compounding the friction and narrowing the realistic attacker population to insiders or post-phishing operators already inside the network.
• No weaponization signals: Zero public PoC, no exploit framework modules, no in-the-wild exploitation reported, and EPSS at 0.6% — all indicators that the vulnerability has not been operationalized and is unlikely to see mass exploitation in the near term.
• Role multiplier — SYSTEM on domain controllers: The Windows Event Logging Service runs as NT AUTHORITY\SYSTEM on every Windows host, including domain controllers. On a DC, SYSTEM access enables DCSync and full domain credential compromise. DCs represent ~2-5% of enterprise Windows hosts, well above the 1% floor threshold. This role multiplier hard-floors the verdict at HIGH despite the significant exploitation friction. On Hyper-V hosts, SYSTEM could enable hypervisor-level pivoting; on SIEM forwarders, it compromises the detection plane.
• Scope Unchanged limits lateral blast: The CVSS S:U means the vulnerability's direct impact is confined to the target host. Fleet-scale compromise requires chaining additional lateral movement steps after initial SYSTEM access, adding further practical friction beyond the initial exploit.

Why not higher?

CRITICAL would require either active exploitation, a public PoC enabling mass weaponization, or removal of one of the two friction gates (PR:L or UI:R). None of these conditions are met. The UI:R requirement is a hard barrier against wormable or automated exploitation. While the Event Logging Service runs on every Windows host including DCs, it is not canonically a high-value-role-*only* component — it runs universally, so the high-value-role percentage (~2-5% DCs) does not meet the ≥10% threshold that would mandate a CRITICAL floor.

Why not lower?

MEDIUM would require either a substantially limited affected population or a blast radius that doesn't reach domain compromise. Neither holds: the service runs on every Windows host in the fleet (universal exposure), and SYSTEM on a domain controller enables full domain takeover via DCSync. The DC role multiplier hard-floors the verdict at HIGH regardless of exploitation friction. Additionally, the AV:N vector means the vulnerability is reachable from anywhere on the internal network, not just locally.

1. Prioritize patching domain controllers and Tier 0 assets first — SYSTEM on a DC = domain compromise. Apply the July 2026 cumulative update (KB5099535/KB5099538/KB5099540 as applicable) to all DCs, ADCS servers, and PAM hosts within the noisgate HIGH mitigation SLA — within 30 days (by 2026-08-29). These are the highest-blast-radius targets.
2. Restrict RPC and named-pipe access to the Event Logging Service — Use Windows Firewall with Advanced Security or Group Policy to limit which hosts and accounts can reach the EventLog service's RPC endpoints. This narrows the network attack surface without disabling logging. Deploy within 30 days on all servers.
3. Enforce MFA on all interactive and remote logon paths — The PR:L prerequisite means the attacker needs credentials. MFA on RDP, VPN, OWA, and remote management portals raises the bar significantly for credential-reuse attacks from phishing. Verify MFA coverage on all accounts that can reach servers.
4. Enable Credential Guard on supported hosts — If the attacker achieves SYSTEM, Credential Guard prevents extraction of domain credential material from LSASS memory, limiting the post-exploitation blast radius even on a compromised host. Enable on Windows 10/11 Enterprise and Server 2016+ within 30 days.
5. Create EDR detection rule for anomalous svchost.exe child processes — Build a SIEM/EDR alert for unexpected processes (cmd.exe, powershell.exe, rundll32.exe, certutil.exe) spawned by the svchost.exe instance hosting the EventLog service group. This catches post-exploitation regardless of the specific exploit technique used.

Run this script on each target Windows host with local administrator privileges. Example: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-50502.ps1. It checks the OS build number against the patched build thresholds from the July 2026 cumulative updates.

# Check-CVE-2026-50502.ps1
# Verifies whether the host is patched against CVE-2026-50502
# (Windows Event Logging Service RCE - July 2026)
# Run as local administrator on the target host.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

# Patched build thresholds from July 2026 cumulative updates
$patchedBuilds = @{
    '14393' = 9339   # Windows 10 1607 / Server 2016 (KB5099535)
    '17763' = 9020   # Windows 10 1809 / Server 2019 (KB5099538)
    '19044' = 7548   # Windows 10 21H2
    '19045' = 7548   # Windows 10 22H2
    '20348' = 5386   # Windows Server 2022 (KB5099540)
    '26100' = 8875   # Windows 11 24H2 / Server 2025
}

try {
    $os = Get-CimInstance Win32_OperatingSystem
    $majorBuild = $os.BuildNumber
    $ubr = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name UBR).UBR

    Write-Host "Host:  $($env:COMPUTERNAME)"
    Write-Host "OS:    $($os.Caption)"
    Write-Host "Build: $majorBuild.$ubr"
    Write-Host '---'

    if ($patchedBuilds.ContainsKey($majorBuild.ToString())) {
        $requiredUBR = $patchedBuilds[$majorBuild.ToString()]
        if ($ubr -ge $requiredUBR) {
            Write-Host "PATCHED - Build $majorBuild.$ubr meets or exceeds threshold $majorBuild.$requiredUBR"
            exit 0
        } else {
            Write-Host "VULNERABLE - Build $majorBuild.$ubr is below patched threshold $majorBuild.$requiredUBR"
            Write-Host "Action: Apply the July 2026 cumulative update immediately."
            exit 1
        }
    } else {
        # Check for EOL or unrecognized builds
        $knownEOL = @('10240','15063','16299','18362','18363','19041','19042','19043')
        if ($knownEOL -contains $majorBuild.ToString()) {
            Write-Host "VULNERABLE - Build $majorBuild is end-of-life and will not receive a patch."
            Write-Host "Action: Upgrade to a supported Windows version."
            exit 1
        }
        Write-Host "UNKNOWN - Build $majorBuild is not in the known affected/patched list."
        Write-Host "Verify manually against the MSRC advisory."
        exit 2
    }
} catch {
    Write-Host "UNKNOWN - Error retrieving OS build information: $_"
    exit 2
}

Sources

1. Microsoft MSRC Advisory — CVE-2026-50502
2. Windows News — July Patch Tuesday RCE in Windows Event Logging
3. Cisco Talos — Microsoft Patch Tuesday July 2026
4. Qualys ThreatPROTECT — July 2026 Patch Tuesday Review
5. Lansweeper — Microsoft Patch Tuesday July 2026
6. CCB Belgium — July 2026 Patch Tuesday Advisory
7. CISA Known Exploited Vulnerabilities Catalog