# CVE-2026-50328: Microsoft Windows Server Update Service uncaught exception

Source: https://junglewise.ai/threats/cve-2026-50328-microsoft-windows-server-update-service-uncaught-exception  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-50328 · Severity: high · CVSS 7.5 · Published 2026-07-14

A vulnerability in the Windows Server Update Service (WSUS) could allow an unauthorized attacker to disrupt the update process across a network. WSUS is a critical tool used by organizations to manage and distribute software updates to computers within their environment. An exploit could lead to a denial of service, preventing systems from receiving essential security patches and potentially impacting overall network stability.

Technologies: [Microsoft Windows Server Update Services (WSUS)](https://junglewise.ai/threats/technologies/windows-server-update-services-wsus). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-50328 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50328 being exploited in the wild.

**How severe is CVE-2026-50328?** High severity, with a CVSS score of 7.5, published 14 July 2026.

**Which products and versions are affected?** Microsoft Windows Server Update Service (WSUS) Windows 10, Windows Server 2012, 2016, 2019.

**Is there a fix for CVE-2026-50328?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50328 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-50328?** Check whether you run Microsoft Windows Server Update Services (WSUS). Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in Windows Server Update Service (WSUS) due to improper input validation leading to an uncaught exception (CWE-248). An unauthenticated attacker can exploit this over the network without user interaction. While the advisory mentions 'tampering,' the provided CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) specifically indicates a high impact on availability, suggesting a Denial of Service (DoS) condition. Affected versions include various releases of Windows 10 and Windows Server (2012 through 2019). Microsoft has released security updates to address this issue.

## Affected products

- Microsoft Windows Server Update Service (WSUS) Windows 10, Windows Server 2012, 2016, 2019

## Timeline

- 2026-07-14: disclosed
- 2026-07-14: advisory

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50328](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50328)

## Related threats

- [Microsoft Windows Server Update Service privilege escalation](https://junglewise.ai/threats/cve-2026-50444-microsoft-windows-server-update-service-privilege-escalation)
- [Microsoft Windows Server Update Service remote code execution](https://junglewise.ai/threats/cve-2026-20856-microsoft-windows-server-update-service-remote-code-execution)