CVE-2026-50441: Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

Q: Who can exploit this vulnerability?

An attacker must already be authorized on the affected system and have local access. The vulnerability is an elevation-of-privilege issue, so it is relevant where lower-privileged local users or processes could run on a Windows host.

Q: What systems are listed as affected?

The affected software list includes Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Windows 10 21H2 and 22H2 are also specifically listed.

Q: What level of impact could successful exploitation have?

Successful exploitation could allow elevation of privileges on the local system. The supplied severity vector indicates high impacts to confidentiality, integrity, and availability.

Published Jul 14, 2026

Updated

Untrusted pointer dereference in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

Other sources

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

— Microsoft

Affected Software

43 affected componentsFixes available

Microsoft Windows 10=21H2

10.0.19044.7548

Microsoft Windows 10=22H2

10.0.19045.7548

Microsoft Windows 10=21H2

10.0.19044.7548

Microsoft Windows 10=21H2

10.0.19044.7548

Microsoft Windows Server 2019<10.0.17763.9020

10.0.17763.9020

Microsoft Windows Server 2022<10.0.20348.5386

10.0.20348.5386

Microsoft Windows 10=22H2

10.0.19045.7548

Microsoft Windows Server 2019<10.0.17763.9020

10.0.17763.9020

Microsoft Windows 10=22H2

10.0.19045.7548

Microsoft Windows 11=26H1

10.0.28000.2525

Microsoft Windows Server 2025<10.0.26100.33158

10.0.26100.33158

Microsoft Windows 10=1809

10.0.17763.9020

Microsoft Windows 10=1607

10.0.14393.9339

Microsoft Windows 10=1809

10.0.17763.9020

Microsoft Windows Server 2016<10.0.14393.9339

10.0.14393.9339

Microsoft Windows Server 2016<10.0.14393.9339

10.0.14393.9339

Microsoft Windows 11=24H2

10.0.26100.8875

Microsoft Windows Server 2025<10.0.26100.33158

10.0.26100.33158

Microsoft Windows 11=25H2

10.0.26200.8875

Microsoft Windows 10=1607

10.0.14393.9339

Microsoft Windows 11=25H2

10.0.26200.8875

Microsoft Windows 11=24H2

10.0.26100.8875

Microsoft Windows 10 1607<10.0.14393.9339

Microsoft Windows 10 1809<10.0.17763.9020

Microsoft Windows 10 21h2<10.0.19044.7548

Microsoft Windows 10 22h2<10.0.19045.7548

Microsoft Windows 11 24h2<10.0.26100.8875

Microsoft Windows 11 25h2<10.0.26200.8875

Microsoft Windows 11 26h1<10.0.28000.2269

Microsoft Windows 11 26h1<10.0.28000.2525

Microsoft Windows Server 2016<10.0.14393.9339

Microsoft Windows Server 2019<10.0.17763.9020

Microsoft Windows Server 2022<10.0.20348.5386

Microsoft Windows Server 2025<10.0.26100.33158

Microsoft Windows 11=26H1

10.0.28000.2525

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.7548Patch KB5099539
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19045.7548Patch KB5099539
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.9020Patch KB5099538
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5386Patch KB5099540
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.2525Patch KB5101649
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33158Patch KB5099536
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.9339Patch KB5099535
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.8875Patch KB5101650
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.8875Patch KB5101650

Event History

Jul 14, 2026

CVE Published

via Microsoft·02:00 PM

Data Sourced

via Microsoft·02:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·05:07 PM

Data Sourced

via MITRE·05:07 PM

DescriptionSeverity

Data Sourced

via NVD·06:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must already be authorized on the affected system and have local access. The vulnerability is an elevation-of-privilege issue, so it is relevant where lower-privileged local users or processes could run on a Windows host.

What systems are listed as affected?

The affected software list includes Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Windows 10 21H2 and 22H2 are also specifically listed.

What level of impact could successful exploitation have?

Successful exploitation could allow elevation of privileges on the local system. The supplied severity vector indicates high impacts to confidentiality, integrity, and availability.

CVE-2026-50441: Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What systems are listed as affected?

What level of impact could successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What systems are listed as affected?

What level of impact could successful exploitation have?