CVE-2026-50391: Windows Group Policy Client Elevation of Privilege

HERMES

HERMES THREAT SCORE & GROUP POLICY ENGINE HIJACKING

Target: Windows Group Policy Client (gpsvc.dll / gpedit.dll)

Confidence: 94%

87 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 15 / 20

Weaponization 17 / 20

Exposure 18 / 20

Prevalence 20 / 20

Impact 19 / 20

Exploit Maturity 17 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-50391 at 7.8 (HIGH, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The Hermes Threat Score assigns 87 (HIGH) because Group Policy is the authoritative deployment mechanism for enterprise configurations, making CSE abuse a primary vector for stealthy SYSTEM escalation and persistence.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-50391: Windows Group Policy Client Elevation of PrivilegeVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Policy Processing Vulnerability: Group Policy CSE Privilege Escalation

CVSS v3.1 : 7.8 HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) / CWE-269: Improper Privilege Management. Addressed in Microsoft’s July 2026 updates affecting the Windows Group Policy Client service (gpsvc).

Executive Summary

CVE-2026-50391 is a local elevation of privilege vulnerability in the Windows Group Policy Client engine (gpsvc.dll). The flaw arises from insecure temporary file processing and junction redirection during the application of Client-Side Extensions (CSEs). A local authenticated user can create symbolic links in the user-writable Group Policy staging directory, tricking the high-privilege gpsvc service into overwriting critical system binaries and executing arbitrary code as NT AUTHORITY\SYSTEM.

---

1. Technical Context & Affected Software Matrix

The Windows Group Policy Client service (gpsvc) runs inside svchost.exe under the NT AUTHORITY\SYSTEM account, processing GPO settings received from Domain Controllers.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-50391	MSRC Bulletin July 2026
Vulnerable Component	Windows Group Policy Client (gpsvc.dll)	Endpoint configuration enforcement engine
CWE Weakness	CWE-269: Improper Privilege Management	File handling race condition and directory junction follow
CVSS v3.1 Score	7.8 (HIGH / Hermes Severity 87)	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector	Local authenticated user	Privilege escalation to NT AUTHORITY\SYSTEM
Affected Platforms	Windows 10, Windows 11 (22H2-24H2), Windows Server 2019, 2022, 2025	All domain-joined and standalone Windows hosts
Microsoft Patches	Cumulative Updates July 2026 (KB5040442, KB5040437, KB5040445)	High-priority endpoint patch

---

2. In-Depth Technical Decomposition & Root Cause

During Group Policy background refresh (triggered by gpupdate /force or scheduled interval), gpsvc.dll processes per-user and per-machine extensions (such as Scripts, Registry, or Scheduled Tasks CSEs).

When staging script policies for user logons, gpsvc extracts files into %LocalAppData%\Microsoft\GroupPolicy\History. Because this directory is owned by the interactive user, an attacker can replace target subdirectories with an NTFS directory junction pointing to C:\Windows\System32:

// Conceptual depiction of CVE-2026-50391 file operation flaw
DWORD ApplyUserScriptPolicy(
    LPCWSTR pwszGpoPath,
    HANDLE hUserToken
) {
    WCHAR wszStagingPath[MAX_PATH];
    GetStagingDirectoryForUser(hUserToken, wszStagingPath, MAX_PATH);

    // VULNERABILITY: gpsvc opens destination files while running as SYSTEM,
    // without enforcing FILE_FLAG_OPEN_REPARSE_POINT!
    HANDLE hFile = CreateFileW(
        wszStagingPath,
        GENERIC_WRITE,
        0,
        NULL,
        CREATE_ALWAYS,
        FILE_ATTRIBUTE_NORMAL, // Lacks reparse point mitigation
        NULL
    );

    // If wszStagingPath has been converted into an NTFS junction pointing to System32,
    // gpsvc writes arbitrary files into protected system directories as SYSTEM.
    WritePolicyData(hFile, pwszGpoPath);
    CloseHandle(hFile);
    return ERROR_SUCCESS;
}

By directing the junction to a protected DLL directory (e.g. C:\Windows\System32\wbem\), the attacker plants a malicious DLL that gets loaded by a privileged system service, yielding immediate SYSTEM execution.

---

3. Attack Vectors & Enterprise Threat Scenarios

[ Low-Privilege Local User on Workstation ]
               │
               ▼ (Create NTFS Junction in %LocalAppData%\Microsoft\GroupPolicy\History)
[ Trigger Group Policy Background Refresh (gpupdate) ]
               │
               ▼ (CVE-2026-50391 Arbitrary File Write as SYSTEM via gpsvc.dll)
[ Plant Malicious DLL in Protected System Directory ]
               │
               ▼ (Service Restart / DLL Hijacking)
[ Full NT AUTHORITY\SYSTEM Privilege Escalation ]

Forensic Correlation with Active Directory Corpus

• GPOs as Lateral Movement and Persistence: How attackers manipulate GPOs to distribute commands enterprise-wide. See AD-31: Group Policy Objects (GPO): lateral movement and persistence.
• Access Tokens and Security Context: Understanding how processes transition from user tokens to SYSTEM tokens. See AD-06: Windows access tokens and security context.
• Local Admin vs Domain Admin: Distinguishing workstation compromise from domain-level escalation. See AD-04: Local Admin vs Domain Admin.

---

4. Forensic Detection, Artefacts & Event IDs

Investigating CVE-2026-50391 involves monitoring file integrity in system folders and Group Policy operational events:

Essential Artefacts & Event IDs

• Microsoft-Windows-GroupPolicy/Operational Event ID 5312: “List of policies applied to computer and user” indicating abnormal policy refresh timings.
• Sysmon Event ID 11 (FileCreate): Look for file write events into C:\Windows\System32\ where the Image is C:\Windows\System32\svchost.exe -k netsvcs -p -s gpsvc.
• Sysmon Event ID 1 (ProcessCreate): Execution of unsigned binaries from System32 or SysWOW64 shortly after a GPO refresh cycle.

KQL Query: Abnormal File Creations by gpsvc

DeviceFileEvents
| where InitiatingProcessFileName =~ "svchost.exe"
| where InitiatingProcessCommandLine has "gpsvc"
| where FolderPath startswith "C:\\Windows\\System32\\"
| where FileName endswith ".dll" or FileName endswith ".exe"
| project Timestamp, DeviceName, FolderPath, FileName, ActionType, InitiatingProcessAccountName
| order by Timestamp desc

---

5. Remediation, Hardening & Defensive Engineering

1. Deploy July 2026 Patches: Install KB5040442 / KB5040437 across all enterprise workstations.
2. Restrict Symbolic Links: Disable the creation of unprivileged symbolic links via Group Policy (Create symbolic links: Administrators only).
3. Enforce WDAC / AppLocker: Prevent execution of unauthorized binaries in system directories using Windows Defender Application Control.