CVE-2026-50508

CVSS 3.1: 7.5 high
EPSS: 9%p95
Published: Jun 9, 2026 · Jun 9, 2026
Modified: Jul 23, 2026

Analyze CVE-2026-50508 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

Vendors: microsoft

Products: windows 10 1607, windows 11 22h2, windows server 2004, windows server 2012, windows server 2016, windows server 2022

Weakness: CWE-200

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (8.7%)

In the news

1 story

ZDI-26-605: Microsoft Windows Localized Filenames Improper Input Validation NTLM Response Information Disclosure Vulnerability

ZDI advisory ZDI-26-605 details an improper input validation flaw (CVE-2026-50508, CVSS 3.3) in Microsoft Windows localized filenames that leaks NTLM responses.

ZDI Published AdvisoriesAug 24, 05:00 UTC · Aug 24, 2026AdvisoryCVE-2026-505082 · 1 read