Relative Path Traversal in Microsoft Windows and Windows Server - CVE-2026-50426
Published: July 17, 2026
Vulnerability identifier: #VU138039
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-50426
CWE-ID: CWE-23
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute code.
The vulnerability exists due to relative path traversal in DNS Server when processing crafted path input over an adjacent network. A remote privileged user can supply a crafted relative path to execute code.
Exploitation is limited to systems on the same network segment, such as the same network switch or virtual network.
Affected software
Microsoft Windows
Windows Server
Windows Server
How to mitigate CVE-2026-50426
Install security update from vendor's website.
Microsoft Windows - addressed in versions 10 1607 10.0.14393.9339, 10 1809 10.0.17763.9020, 11 26H1 10.0.28000.2525
Windows Server - addressed in versions 2012 R2 6.3.9600.23291, 2012 6.2.9200.26226, 2016 10.0.14393.9339, 2019 10.0.17763.9020, 2022 10.0.20348.5386, 2025 10.0.26100.33158
Windows Server - addressed in versions 2012 R2 6.3.9600.23291, 2012 6.2.9200.26226, 2016 10.0.14393.9339, 2019 10.0.17763.9020, 2022 10.0.20348.5386, 2025 10.0.26100.33158