CVE-2026-50508

CVE-2026-50508 is a network-exploitable NTLM spoofing vulnerability in Windows 10 1607, an operating system released in 2016. The CVSS 7.5 score reflects a genuine risk: an unauthenticated attacker on the network can spoof authentication sessions by manipulating NTLM challenge-response exchanges. The EPSS score of 0.08678 indicates this is not a speculative threat — the exploitability curve will climb as tooling matures and relay chains get weaponized. Here is what you should do: First, confirm whether NTLM is still enabled in your environment. Check the registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\LMCompatibilityLevel — values below 5 mean NTLM v1 or LM hash is active. If you find it enabled, the immediate question is not whether to disable it but whether you can identify what breaks. Second, audit your authentication topology: enumerate systems publishing NTLM-authenticated services (print spoolers, file shares, legacy web apps) and map the trust relationships downstream from each relay point. The CVSS score measures one vulnerability; the blast radius extends through every system reachable via NTLM relay chains in your network segment. Third, treat this as a family event, not an isolated incident. NTLM spoofing vulnerabilities cluster around specific interaction points between legacy and modern authentication code paths — this is the fourth or fifth such CVE in the past three years. Your response should include a migration plan with a hard timeline, not a point-in-time patch. Finally, accept that patching Windows 10 1607 may not be the bottleneck — the bottleneck is the application dependency that requires NTLM. Your remediation timeline should be driven by application migration, not OS patching. If you are still running 1607 in production in 2026, you are operating on borrowed time regardless of this specific CVE.

Reviewed through automated stages and approved by a human before publication.