CVE-2026-50511: Microsoft PC Manager Elevation of Privilege Vulnerability

Synopsis

A link-following vulnerability (also called a symlink or junction attack) in Microsoft PC Manager allows a locally authenticated attacker to elevate their privileges on the affected machine. The attacker must already have a low-privilege account on the host; no network access or user interaction is required. Successful exploitation gives the attacker full read, write, and execution capabilities at a higher privilege level, effectively taking control of the system. A patched-image rebuild at version 3.21.6.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative credentials to begin the attack.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is needed; the attacker can execute the exploit entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or specific memory-layout requirements to satisfy.

Blast Radius

• A successful attacker reads files and data protected by higher-privilege accounts, including credentials and configuration secrets stored on the host.
• The attacker writes or overwrites files anywhere on the filesystem accessible to the elevated privilege level, including system binaries and configuration.
• The attacker executes arbitrary code at elevated privilege, enabling persistence mechanisms such as scheduled tasks or service installations.
• All three impacts (confidentiality, integrity, and availability) are rated High in the CVSS vector, meaning the attacker can also disrupt or crash system services after privilege escalation.