CVE-2026-50302Important

Windows Cryptographic Services Security Feature Bypass Vulnerability

Assessment

Improper certificate validation in Windows Cryptographic Services allows an unauthorized attacker to bypass a security feature over a network.

Severity: Important
CVSS base score: 4.2CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C
Impact: Security Feature Bypass
EPSS, next 30 days: 0.3%Higher than 24.2% of scored CVEs · FIRST model run 26 Sep 2026 · about EPSS
Exploitability: Exploitation Unlikely
Publicly disclosed: No
Customer action: Required: apply the update
Component: Windows Cryptographic Services
Weakness: CWE-295: Improper Certificate Validation
Issued by: Microsoft
Published: 14 Jul 2026 · July 2026
Last revised: 14 Jul 2026

5 KBs

KB	Type	Restart	Applies to	Other CVEs
KB5099536	Security Update	Required	Windows Server 2025, Windows Server 2025 (Server Core installation)	All CVEs in KB5099536
KB5099539	Security Update	Required	Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems and 3 more	All CVEs in KB5099539
KB5099540	Security Update	Required	Windows Server 2022	All CVEs in KB5099540
KB5101649	Security Update	Required	Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems	All CVEs in KB5101649
KB5101650	Security Update	Required	Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems and 1 more	All CVEs in KB5101650

ESU, Windows

15 affected products