CVE-2026-50502
Microsoft Windows 10 21H2 ≤ 10.0.19044.7548
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2026-50502 is a high-severity Insufficient Granularity of Access Control (CWE-1220) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-44095
Vulnerability Data
Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in Windows Event Logging Service enables remote code execution over network by authorized attacker due to weak access controls.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces fine-grained access decisions on the Event Logging Service to block the overly permissive paths that enable remote code execution.
Requires assignment of only the minimum privileges needed, directly countering the insufficient granularity described in CWE-1220.
Enforces information flow rules between network callers and the logging service, limiting the blast radius of an authorized but over-privileged user.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.IR-01's segmentation + zero-trust rules directly enforce minimum-necessary access at network boundaries, removing most instances of overly broad policy; CWE-1220 can still exist in application-layer or intra-segment controls that this single outcome does not address.
PR.PS-06's general SDLC practices can surface granularity issues during design/review (partial prevention) but do not specifically target access-control policy breadth, so they remove only part of CWE-1220's risk.
CWE-1220 permits unauthorized access to sensitive assets but neither prevents nor impairs the delivery of adverse-event information to authorized recipients.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly requires information-access restriction at the level of individual assets and operations, addressing the granularity gap.
Establishes the overarching access-control policy whose granularity directly determines whether the weakness exists.
Defines the assignment and review of access rights; insufficient granularity in those rights is the root of CWE-1220.
Specifies management of privileged access rights, where overly broad privileges are a common manifestation of the weakness.
Limits use of privileged utilities; overly coarse access rules can still allow unauthorized utility access.