CVE-2026-50438: Microsoft PC Manager privilege escalation via improper link resolution

CVE-2026-50438 · Severity: high · CVSS 8.8 · Published 2026-07-14

Microsoft PC Manager, a tool used for system maintenance and performance optimization, contains a security flaw that could allow a user with limited access to gain full control over a computer. By exploiting how the application handles file shortcuts, an attacker who already has a basic account on the system can escalate their permissions to a higher level. This could lead to unauthorized access to sensitive data, system-wide changes, or the installation of malicious software.

Technologies: Microsoft PC Manager. Vendors: Microsoft.

Quick answers

Is CVE-2026-50438 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50438 being exploited in the wild.
How severe is CVE-2026-50438?
High severity, with a CVSS score of 8.8, published 14 July 2026.
Which products and versions are affected?
Microsoft PC Manager 1.0.0 to 3.22.1.0.
Is there a fix for CVE-2026-50438?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-50438 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-50438?
Check whether you run Microsoft PC Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in Microsoft PC Manager due to improper link resolution before file access (CWE-59). The flaw allows a local attacker with low-level privileges to create symbolic links or junctions that redirect the application's file operations to protected system locations. Because the application performs these operations with higher privileges, the attacker can manipulate system files to achieve a full privilege escalation. The vulnerability affects versions 1.0.0 through 3.22.1.0 and has been addressed in subsequent updates.

Affected products

  • Microsoft PC Manager 1.0.0 to 3.22.1.0

Timeline

  • 2026-07-14: disclosed: Initial publication of CVE-2026-50438 by Microsoft.
  • 2026-07-14: advisory: NVD entry created.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.