CVE-2026-49176

Published Jul 14, 2026

Last updated 5 days ago

CVSS high 7.8
Windows
Windows WalletService

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-49176 is a local privilege escalation vulnerability found in the Microsoft Windows WalletService component. This flaw stems from improper privilege management combined with link-following behavior (CWE-59). An authorized local attacker can exploit this vulnerability to gain SYSTEM-level privileges on affected Windows client and server editions. The WalletService, which manages wallet-related objects and credentials, performs privileged file or object operations without adequately validating the identity or trust boundary of resources it interacts with. Because the service operates with elevated rights, a standard local user can influence these operations to act on attacker-controlled paths, often involving symbolic links, junctions, or mount points. Microsoft addressed this issue through its security update guide, and a public proof-of-concept has been published on GitHub.

Description
Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.
Source
secure@microsoft.com
NVD status
Analyzed
Products
windows_10_1607, windows_10_1809, windows_10_21h2, windows_10_22h2, windows_11_24h2, windows_11_25h2, windows_11_26h1, windows_server_2016, windows_server_2019, windows_server_2022, windows_server_2025

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

secure@microsoft.com
CWE-59

Social media

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score

9

Configurations

References

Sources include official advisories and independent security research.