Public Exploit Code Released for CVE-2026-50343, a Windows InstallService Flaw That Grants SYSTEM Privileges
Do Son 
TL;DR
Researchers at Calif.io published full technical details and working proof-of-concept exploit code for CVE-2026-50343, tracked as Dark Elevator. The Windows privilege escalation bug, rated CVSS 7.8, lets any standard user land an interactive NT AUTHORITY\SYSTEM shell. Microsoft shipped the fix in its July Patch Tuesday release.
Why It Matters
The preconditions are almost nonexistent. An attacker needs no administrator rights, no UAC prompt, no reboot, and no control over the service. Code execution then lands inside a Microsoft-signed SYSTEM process.
From there, an attacker can create privileged accounts, install services, read other users’ data, disable local security controls, and set up persistence with SYSTEM privileges. The chain corrupts no kernel memory, so it works reliably rather than probabilistically.
How the Attack Works
Two logic flaws combine. First, InstallService runs as LocalSystem and decides which fulfillment plugin to load by reading a registry map that standard users can write. That map pairs a plugin ID with a COM class ID, so whoever writes it chooses what the SYSTEM service loads.
Second, a COM class that Windows already ships registers its in-process DLL at a path under ProgramData. Standard users can create files there, and the DLL need not exist beforehand. Together, the two bugs let an unprivileged user supply a DLL that InstallService loads into its own process.
Affected Versions
The research write-up does not enumerate build numbers. Check the affected-product list on the Microsoft advisory for CVE-2026-50343 for your specific Windows releases.
Patch and Mitigation
Apply the July Patch Tuesday updates. No workaround matches the patch, since both weaknesses sit in shipped Windows components.
Until you patch, watch for standard users writing to the InstallService state key, and for new DLLs appearing in ProgramData subfolders. The full analysis lives in the Calif.io Dark Elevator write-up.
Public exploit code raises the stakes. Nobody has confirmed exploitation in the wild yet, but local privilege escalation chains with a published proof-of-concept tend to reach commodity toolkits quickly.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
