A newly disclosed Windows vulnerability gives attackers a surprisingly quiet path to code execution on machines they should have no business touching — and all they need is a set of stolen low-privilege credentials.
The flaw, tracked as CVE-2026-50502 and discovered by French security researcher Romain Bentz, lives inside the Windows Event Log service — a background process most users never think about. Microsoft patched it on July 14, 2026, but a public proof-of-concept exploit has now surfaced, making it urgent for Windows administrators to verify their systems are updated.
A Bypass Built on a Bypass
The story here starts with an earlier vulnerability. In 2025, researchers at SafeBreach uncovered CVE-2025-29969, a TOCTOU (Time-Of-Check, Time-Of-Use) flaw in the same Event Log service. The attack let someone slip an arbitrary file onto a target machine by swapping out a legitimate file after it had already passed inspection. Microsoft closed that gap by adding stricter EVTX format validation at the point of copying.
Bentz noticed the new check had a blind spot: it verified the file header and overall size, but nothing beyond that. By leaving the EVTX header completely intact and appending a malicious script to the tail end — then trimming exactly that many bytes from elsewhere to keep the file size identical — the crafted file sailed through every validation check without complaint.
Where mshta.exe Enters the Picture
Most file parsers would choke on a "hybrid" file like this — a .bat script, for instance, hits the binary EVTX header immediately and never reaches the payload. But the Windows HTA engine (mshta.exe) behaves differently: it scrolls through a file like an HTML renderer, ignores anything it can't interpret — including binary data and null bytes — and simply executes the first valid script block it encounters. That means an embedded VBScript buried at the end of an otherwise legitimate-looking EVTX file runs without hesitation.
How the Attack Unfolds
The attacker hosts the crafted EVTX file on an SMB share they control. Using the Windows Event Log's own RPC interface — authenticated with nothing more than low-privilege network credentials — they remotely instruct the service to copy that file to the victim's Startup folder, giving it an .hta extension in the process.
The next time that user logs into Windows, the Startup folder triggers automatically. mshta.exe opens the file, skips over the EVTX header noise, finds the embedded VBScript, and runs it — in the user's own context, silently.
This is not a privilege escalation to SYSTEM. Code runs only at the compromised user's permission level, which limits the blast radius. But that framing understates the danger in enterprise environments.
Imagine an attacker who has obtained credentials through a phishing campaign or a data breach. The account has no RDP or WinRM access — the usual remote execution doors are shut. Under normal circumstances, those credentials buy reconnaissance, not execution. This vulnerability changes that equation. It converts a set of stolen passwords into the ability to plant and run arbitrary code on a machine, triggered the moment its legitimate owner logs back in.
What You Should Do
Microsoft's July 14, 2026, Patch Tuesday update contains the fix. The path forward is straightforward:
- Open Windows Update and install all pending updates immediately.
- Enterprise and IT teams should prioritize patching on any machines where credentials may have been exposed or where network access is granted to external users.
- Monitor for unexpected SMB connections originating from internal hosts and for unusual file writes targeting user Startup folders — both are indicators of this exploit in action.
- Where operationally feasible, restricting the Event Log service's network exposure through firewall rules adds a meaningful additional layer of defense.
Bentz submitted his findings to France's national cybersecurity agency (FRSC) in March 2026 and coordinated with Microsoft throughout. The patch has been available since July 14 — updating now closes the window before wider exploitation begins.