KB5101650 Closes Windows App Store Race Condition That Lets Attackers Escalate Privileges

On July 14, 2026, Microsoft patched a high-severity flaw in the Windows App Store component that could give an attacker with local access the ability to seize administrative control of a PC or server. Tracked as CVE-2026-50356, the vulnerability carries a CVSS 3.1 base score of 7.0 and was addressed in cumulative update KB5101650 for recent Windows 11 releases. Unlike the usual Store app updates, this fix arrives through the monthly Windows servicing stack—a distinction every user needs to understand.

The Vulnerability: A Race Condition in the Windows App Store Component

CVE-2026-50356 is a race condition, classified as CWE-362, which means the Windows App Store code does not properly synchronize access to a shared resource when multiple operations are running at the same time. An attacker who can trigger overlapping operations at precisely the right moment may create a time-of-check to time-of-use (TOCTOU) scenario. The system verifies a security property, and then, before it acts, the attacker changes the underlying state.

Microsoft’s CVSS vector spells out the practical constraints: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The attack must be launched locally, not over a network. The attacker already needs a low-privileged account or the ability to run code on the machine—credentials that could be gained through phishing, a malicious installer, or another breach. Exploitation is rated high complexity because the race window is narrow and may not be consistently reproducible, but a successful exploit requires no additional user interaction. Once the attacker wins the race, the impact on confidentiality, integrity, and availability is high; they can read, modify, or destroy data and potentially install programs or create new accounts with elevated rights.

The National Vulnerability Database describes the flaw as an elevation of privilege that can be triggered by an authorized attacker. Microsoft rated it “Important,” and CISA’s SSVC assessment noted a total technical impact, meaning the damage could be extensive if exploited. The exact resource being raced and the privileged process involved remain undisclosed, so administrators should assume the vulnerability could affect any Windows system, including servers where the Microsoft Store is rarely launched.

Affected Windows Versions and Patches

Every supported version of Windows 10, Windows 11, and Windows Server received a fix in the July 2026 Patch Tuesday release. The fix comes wrapped inside the monthly cumulative update, not through the Microsoft Store app itself. For Windows 11 versions 24H2 and 25H2, the key update is KB5101650, which raises the OS build to 26100.8875 and 26200.8875, respectively. Windows 11 version 26H1 is vulnerable below build 28000.2269, and older branches like Windows 10 21H2 and 22H2 are patched below builds 19044.7548 and 19045.7548.

Server administrators must act as well. The table below shows the affected builds and the corresponding patched thresholds.

These numbers make one thing clear: opening the Microsoft Store and clicking “Get updates” will not protect you from CVE-2026-50356. Only a Windows OS update replaces the vulnerable component.

What Home Users Should Do Right Now

If you’re running Windows 11, the simplest path is to install KB5101650 through Windows Update. Open Settings > Windows Update, click “Check for updates,” and apply the update. After the restart, verify the build number by running winver from the Start menu. You should see OS Build 26100.8875 or higher for version 24H2, and 26200.8875 or higher for version 25H2.

Windows 10 users on versions 21H2 or 22H2 who are still receiving security updates should install the latest cumulative update listed in Windows Update and check for build 19044.7548 or 19045.7548. If your Windows 10 installation is out of support, you will need an Extended Security Update license to receive this patch.

Do not delay because the attack complexity is high. While exploitation is not as straightforward as a remote code execution bug, a determined attacker can automate retries until the race condition lines up. Once a foothold is established on your device through other means, this vulnerability offers a quick path to total control.

Guidance for IT Administrators

For managed fleets, deploy the appropriate cumulative update through Windows Update for Business, WSUS, or Configuration Manager. Build validation should be part of your compliance checks: rather than simply confirming that the Microsoft Store app works, verify that every endpoint is at or above the patched build thresholds listed above.

Testing is critical because the July 2026 rollup contains other changes beyond CVE-2026-50356. Microsoft has warned that applications relying on third-party TDI transports may stop working after the update, and systems with an unrecommended PCR7 BitLocker policy configuration might see a one-time recovery prompt. Ensure BitLocker recovery keys are escrowed before deploying the update broadly.

If you cannot patch a system immediately, restrict local logon rights and enforce application control policies that limit what can run under AppX or Store-related processes. Also monitor for unusual child processes spawned by the Store component or unexpected privilege changes—though with no public exploitation known, this is a preventive measure rather than a reaction to active attacks.

The Broader July 2026 Security Landscape

CVE-2026-50356 is just one piece of an unusually large Patch Tuesday. BleepingComputer reported that Microsoft addressed 570 vulnerabilities in the July 2026 release, including several that were publicly disclosed or actively exploited in the wild. That broader urgency means every organization should already be prioritizing this month’s updates, and the App Store flaw only adds weight to the argument.

Race conditions like this are not uncommon in complex software, but they can be especially dangerous in operating system components because they break fundamental security barriers. Even with a high complexity rating, developers of attack tools often incorporate such techniques into post-exploitation frameworks, allowing them to reliably escalate privileges when the conditions are right.

Outlook: Staying Ahead of Privilege Escalation Attacks

As of the July 14 release, there is no evidence that CVE-2026-50356 was being exploited in the wild. That could change. Local privilege escalation vulnerabilities are often paired with phishing, drive-by downloads, or lateral movement in enterprise breaches. A standard user account becomes an administrator account with just one well-timed race.

The patch is available and straightforward to apply. On a fully updated Windows 11 machine running KB5101650, this particular attack vector is closed. For everyone else, the clock is ticking—not because exploitation is imminent, but because every unpatched system leaves one more ladder an attacker can climb.