CVE-2026-50512: Microsoft PC Manager Elevation of Privilege Vulnerability

Synopsis

A link-following vulnerability (also called a symlink or junction attack) in Microsoft PC Manager allows a local attacker to elevate their privileges on the affected machine. The attacker must already have a low-privilege account on the system and does not need network access or any help from another user. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system. A patched-image rebuild at version 3.21.6.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to trigger the vulnerability.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative or elevated credentials before exploitation.

• Victim interactionNot required

  No other user needs to take any action; the attacker can execute the attack entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, specific memory layout, or unusual environmental factors.

Blast Radius

• A successful attacker reads protected files, credentials, and application data belonging to other users or the system.
• A successful attacker writes to or replaces protected files, enabling persistent backdoors or corruption of system state.
• A successful attacker can crash or disable the affected service or the host operating system, causing a loss of availability.
• Because all three impact dimensions are HIGH, a single exploitation event can yield full local system compromise in one step.