CVE-2026-50502: Public PoC Exploit Details Windows Event Log Remote Code Execution

TL;DR

A researcher known as Pixis has published full details and proof-of-concept code for CVE-2026-50502. The flaw is a remote code execution bug in the Windows Event Log service, rated CVSS 8.0. Microsoft shipped a fix on July 14, 2026.

Why it matters

The Event Log service runs on every Windows machine. That reach makes CVE-2026-50502 a broad problem, not a niche one.

The bug turns a stolen low-privilege password into code execution. An attacker who cannot open an interactive or remote session can still run code on the host. Microsoft rates the issue Important and confirms remote code execution as the impact.

How the attack works

The flaw lives in the MS-EVEN RPC interface, reached through the \pipe\eventlog named pipe. Two methods matter: ElfrOpenBELW, which opens a backup log, and ElfrBackupELFW, which copies it to a destination.

This bug follows an earlier one, CVE-2025-29969, found by SafeBreach. Microsoft’s fix for that added an EVTX format check at backup time. The new work shows that check only inspects the file structure.

As a result, an attacker can keep a valid EVTX header and append a payload at the end. The technical write-up by researcher Pixis on the ElfrBackupELFW flaw explains that the mshta.exe engine will still run the trailing script. The attacker serves the file over SMB, then writes it into a user’s Startup folder as an .hta file.

Limited by design

The write happens with the user’s own rights, so no jump to SYSTEM occurs. The author calls the real-world impact “plutôt limité”, meaning rather limited. Code runs only after the targeted user next logs in.

Affected versions

The issue affects all supported Windows releases. According to Patch Tuesday coverage, that includes Windows 10, Windows 11, and Windows Server editions from Server 2012 onward.

Exploitation status

A public proof-of-concept exists, since the researcher released working code. Microsoft’s advisory, by contrast, marks exploitation as unproven and lists no in-the-wild activity.

Patch and mitigation

Apply the July 2026 update without delay. Microsoft’s official CVE-2026-50502 security advisory is the authoritative source for build numbers.

Two extra steps help where patching lags. First, block outbound SMB to untrusted hosts, which cuts the remote file source. Second, audit Startup folders for unexpected .hta files.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.