CVE-2026-50663, Age of Empires II Path Traversal and Patch Validation

CVE-2026-50663 is a high-severity relative path traversal vulnerability in Age of Empires II: Definitive Edition. Microsoft states that an unauthorized attacker can exploit the flaw over a network to execute code. The Microsoft-assigned CVSS 3.1 score is 8.8, with no prior privileges required, low attack complexity, and user interaction included in the attack path. The affected range begins at version 1.0.0 and ends before version 101.103.46651.0. (NVD)

The product scope matters. CVE-2026-50663 should not be described as a generic Microsoft Windows directory traversal vulnerability. It is assigned specifically to Age of Empires II: Definitive Edition, a game that supports multiplayer lobbies, downloadable scenarios, mods, custom campaigns, and other forms of community-created content. The security issue sits at the boundary between network-delivered game content and the local file system.

Rapid7 reported that a malicious game scenario could cause files to be placed in unexpected locations and potentially lead to code execution. A public demonstration posted after the July 2026 disclosure showed a victim joining an attacker-controlled lobby and accepting user-generated content before remote code execution occurred. At the time of the first public reporting, no confirmed in-the-wild exploitation had been identified. (Rapid7)

That combination makes the vulnerability important but easy to mischaracterize. It is not a zero-click Internet worm. It requires a user-mediated action. It is also not merely a harmless file placement bug. If an attacker can control where a file is written and can reach a location from which the operating system, the game, or another trusted component later loads code, relative path traversal can become remote code execution.

Risk at a glance

Field	Confirmed information
CVE	CVE-2026-50663
Product	Age of Empires II: Definitive Edition
Weakness	CWE-23 Relative Path Traversal
Security impact	Remote code execution
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality impact	High
Integrity impact	High
Availability impact	High
CVSS 3.1 score	8.8 High
Affected versions	Version 1.0.0 through versions below 101.103.46651.0
Microsoft exploitation assessment at release	Exploitation Less Likely
Publicly disclosed before release	No, according to the July 14 assessment
CISA ADP exploitation status on July 15	None observed
Validation priority	High for systems where the game was used with multiplayer or untrusted community content

The Microsoft CNA vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD was still marking the entry as awaiting enrichment on July 15, 2026. That means the available CVSS score and affected-version information came from Microsoft as the assigning CNA rather than a completed independent NVD analysis. (NVD)

What Microsoft confirmed

The public CVE record establishes several facts that defenders can rely on.

First, the affected software is Age of Empires II: Definitive Edition. The CVE does not identify Windows itself, the Microsoft Store, Xbox services, Steam, or a generic archive library as the vulnerable product.

Second, Microsoft maps the flaw to CWE-23, Relative Path Traversal. This weakness occurs when externally controlled path information is used to build a file-system destination, but the software does not adequately prevent the resulting path from resolving outside an intended directory.

Third, Microsoft states that an unauthorized attacker can execute code over a network. The CVSS vector supports that description: the attacker does not need an existing account or local access to the target, but the victim must interact with attacker-controlled content.

Fourth, the affected-version record is unusually valuable because it supplies a precise full version boundary:

Affected: 1.0.0 and later
Fixed boundary: 101.103.46651.0
Vulnerable condition: version < 101.103.46651.0

Fifth, the maximum technical consequences cover confidentiality, integrity, and availability. Successful exploitation should therefore be treated as potential compromise of the current user’s security context rather than as a game-only stability problem. (NVD)

What the public record does not establish

The CVE description is concise. Microsoft has not publicly documented the vulnerable function, the exact parser, the relevant source-code branch, the crafted file structure, or the code-loading mechanism that converts file placement into execution.

Public sources do not conclusively establish all of the following:

• The exact malicious content format.
• The exact pathname accepted by the vulnerable component.
• The final destination used in the public demonstration.
• Whether exploitation relies on archive extraction, scenario installation, mod synchronization, temporary lobby content, or another content-processing path.
• Whether the final code execution occurs immediately or after a secondary load event.
• Whether every supported platform is affected in the same way.
• Whether the vulnerable logic is shared across storefront builds.
• Whether a universal set of file hashes or network indicators can identify exploitation.
• Whether the June update notes intentionally omitted a security fix or whether the relevant change was part of a broader engineering modification.

Rapid7’s description is narrower and more defensible than claims of arbitrary unauthenticated file-system control: exploitation can place malicious files in unexpected locations, potentially enabling code execution. The public demonstration adds evidence that multiplayer lobby content can reach the vulnerable path, but it does not reveal enough detail to reproduce the complete exploit safely or reliably. (Rapid7)

Security teams should preserve this distinction. A technically plausible explanation is not the same as a vendor-confirmed exploit chain.

The July 2026 disclosure and the earlier game update

CVE-2026-50663 was published on July 14, 2026, as part of Microsoft’s July security release. Rapid7’s Patch Tuesday table listed the flaw as an Age of Empires II: Definitive Edition remote code execution vulnerability, rated it 8.8, recorded Microsoft’s “Exploitation Less Likely” assessment, and indicated that it had not been publicly disclosed before the release. (Rapid7)

The relevant Age of Empires update page, however, is dated June 2, 2026. It documents Update 177723 and instructs Microsoft Store, Steam, and Xbox App users to open the game and confirm that the title screen reports Build 177723. The release notes describe broad stability, multiplayer, lobby, interface, console, and gameplay changes, but the visible public notes do not mention CVE-2026-50663. (Age of Empires / World’s Edge Studio)

This creates an important operational distinction:

• Security disclosure date: July 14, 2026.
• Public Update 177723 release date: June 2, 2026.
• Full fixed-version boundary in the CVE record: 101.103.46651.0.
• Short player-facing build shown by the update page: 177723.

The public materials do not explicitly explain how the shorter build label maps to the full four-part version string. Defenders should therefore retain both values in their evidence rather than silently substituting one for the other.

For an individual player, the title-screen build is the easiest official check. For an enterprise inventory, a complete file or package version may be available through endpoint tooling. A defensible validation record can state:

Title-screen build: 177723 or later
Full product version, when available: 101.103.46651.0 or later
Distribution channel: Steam, Microsoft Store, or Xbox App
Evidence collection date: YYYY-MM-DD

Later official builds should normally contain fixes from earlier releases, but security teams should not use a larger-looking number from an unrelated version field without confirming what that field represents.

Why Windows Update history is not enough

The phrase “July 2026 patch” may lead administrators to search the Windows Update control panel for a corresponding KB package. That is not a reliable validation method for this CVE.

Age of Empires II: Definitive Edition is distributed through application storefronts. The official update instructions tell users to update through the Microsoft Store, Steam, or the Xbox App and then verify the build from inside the game. Steam users may need to open the Downloads area and manually start the update if it did not begin automatically. Microsoft Store users are instructed to check for updates, while Xbox App users can use the app’s update or file-management controls. (Age of Empires / World’s Edge Studio)

A Windows endpoint can therefore be fully current on operating-system cumulative updates while still running an outdated game package. The reverse is also possible: the game could have received Update 177723 before the CVE became public, even if July Windows updates had not yet been installed.

A complete patch-validation workflow must answer four separate questions:

1. Is the game installed?
2. Which copy of the game is actually launched?
3. What version is that copy running?
4. Was the endpoint potentially exposed before it was updated?

Only the third question determines current vulnerability status. The fourth determines whether incident-response work may still be necessary.

Timeline

Date	Event	Security significance
June 2, 2026	Age of Empires II Update 177723 released	Public game update predates the CVE disclosure
July 14, 2026	Microsoft publishes CVE-2026-50663	Vulnerability, CVSS score, CWE, and affected version boundary become public
July 14, 2026	Rapid7 publishes July Patch Tuesday analysis	Describes malicious scenario handling and unexpected file placement
July 15, 2026	Public demonstration appears	Shows a multiplayer-lobby and user-generated-content path to RCE
July 15, 2026	CISA ADP adds SSVC data	Records exploitation none, automatable no, and total technical impact
July 16, 2026	Current assessment date	No reliable public evidence of widespread in-the-wild exploitation identified in the cited sources

The CISA ADP data should not be read as a permanent guarantee that exploitation does not exist. It is a time-stamped assessment. Likewise, Microsoft’s “Exploitation Less Likely” label describes expected exploitation probability, not technical severity or the absence of a working exploit. (NVD)

How relative path traversal works

A file-processing component usually begins with an intended destination directory. For example:

C:\GameData\DownloadedContent

It then receives a file name from external content:

maps\scenario.dat

A naive implementation joins the two values:

C:\GameData\DownloadedContent\maps\scenario.dat

That result remains inside the intended directory.

The security problem appears when an attacker can provide path segments such as:

..\escaped-file.dat

After the operating system resolves the .. segment, the actual destination becomes:

C:\GameData\escaped-file.dat

The file has escaped the intended DownloadedContent directory.

MITRE defines CWE-23 as using external input to construct a pathname that should remain in a restricted directory without properly neutralizing sequences such as ... MITRE also identifies Zip Slip as a common form of the weakness: archive entries contain traversal sequences that cause files to be written outside the expected extraction directory. (cwe.mitre.org)

OWASP describes path traversal more broadly as manipulating path components, relative sequences, or absolute paths to reach files and directories outside the intended root. The operating system’s access controls still apply, but a game running as the user normally has write access to many locations inside that user’s profile. (OWASP Foundation)

Reading outside a directory and writing outside a directory

Path traversal is often introduced through examples that read sensitive files from a web server. CVE-2026-50663 is more naturally understood as a write-oriented traversal risk.

The distinction is important:

Traversal capability	Typical consequence
Read outside the intended directory	Disclosure of configuration, credentials, source code, or user data
Delete outside the intended directory	Data loss or denial of service
Overwrite outside the intended directory	Corruption, configuration manipulation, or security-control bypass
Create outside the intended directory	File planting, persistence, DLL planting, script placement, or code execution
Create and control file content	Stronger path toward arbitrary code execution

A file write alone does not automatically equal code execution. The destination and file type matter. A harmless text file written to a random folder is not equivalent to a DLL written into an application search path. The serious condition occurs when the target location has execution semantics.

Examples of execution-sensitive destinations include:

• A startup directory.
• A directory scanned for plugins.
• A location from which the application loads scripts.
• A directory searched for DLL dependencies.
• A user profile path processed by a logon component.
• A configuration directory where file contents can alter command execution.
• A location later opened by another vulnerable handler.

Microsoft has not publicly identified which execution-sensitive destination applies to CVE-2026-50663. Those examples explain the vulnerability class; they should not be presented as confirmed exploit details.

Canonicalization must happen before the boundary check

Checking whether the raw input contains the literal string ../ is not sufficient.

On Windows, an implementation may need to account for:

• Backslashes and forward slashes.
• Repeated separators.
• Drive-letter paths.
• UNC paths.
• Device path prefixes.
• Case-insensitive comparisons.
• Trailing dots and spaces.
• Encoded characters.
• Multiple decoding operations.
• Symbolic links.
• Junctions and other reparse points.
• Alternate data streams.
• File-system behavior that changes between validation and writing.

The safer pattern is:

1. Define a trusted extraction root.
2. Reject absolute or device paths.
3. Decode the external name once into a defined internal representation.
4. Join the name to the trusted root.
5. Resolve and canonicalize the resulting destination.
6. Verify that the canonical destination remains inside the canonical root.
7. Reject symbolic-link or reparse-point escapes where relevant.
8. Create files using APIs that reduce race conditions.
9. Apply extension, file-type, size, and count restrictions.
10. Keep extraction and activation separate.

MITRE specifically recommends allowlist validation, canonicalizing before validation, avoiding incomplete character-removal filters, and considering both / and \ as separators where supported. (cwe.mitre.org)

Community content creates a security boundary

Community-created content is a normal part of Age of Empires II: Definitive Edition. Microsoft’s official material describes visual modifications, new game modes, and complete custom campaigns created by the community. The in-game Mod Manager can be used to install such content. (Age of Empires / World’s Edge Studio)

Official support documentation for Age of Empires scenarios also illustrates a traditional download workflow in which a scenario is distributed as a ZIP file, extracted, and placed in a game-content location. That documentation does not prove that the vulnerable Age of Empires II code path uses the same implementation, but it demonstrates why game-content processing deserves the same security treatment as any other archive or package installer. (Age of Empires Support)

The security boundary can be modeled as follows:

Remote player
    |
    v
Multiplayer lobby or content service
    |
    v
Downloaded user-generated content
    |
    v
Game parser, installer, or synchronizer
    |
    v
Local file-system destination
    |
    v
Game or operating-system loading behavior

Every arrow crosses a trust boundary.

The remote player is not trusted merely because they are reachable through an official multiplayer service. The content service can authenticate accounts and transport files without guaranteeing that every internal pathname is safe. A file may be structurally valid as a content package while still containing a dangerous destination name. The game process can be trusted software while processing untrusted data.

The key defensive rule is simple:

The authority to provide game content must never imply the authority to choose arbitrary local file destinations.

Multiplayer increases reach, not necessarily exploitability on every platform

Age of Empires support documentation states that Microsoft Store, Steam, Xbox, and PlayStation users can create and join cross-platform multiplayer matches through a universal lobby. It also notes that participants generally need to be on the same game build to see one another’s lobbies. (Age of Empires Support)

Cross-platform reach broadens the set of accounts from which an invitation or lobby can originate. It does not prove that each platform has the same vulnerable implementation, file-system permissions, or path-to-code-execution chain.

The public CVE data does not provide a per-platform applicability table. The public demonstration and third-party discussion focus on compromise of a victim computer. Defenders should therefore avoid two unsupported conclusions:

• Do not assume consoles are affected in exactly the same way as Windows PCs.
• Do not assume non-PC platforms are safe unless Microsoft explicitly excludes them.

Inventory every deployment channel, prioritize Windows endpoints for host-level hunting, and use vendor-provided version boundaries rather than platform guesswork.

A defensible attack-chain model

The following model separates confirmed information from reasonable inference.

Stage	Description	Evidence level
1	An attacker prepares malicious game-related content	Supported by Rapid7 and public reporting
2	The attacker delivers or exposes the content over a network	Confirmed by Microsoft’s network attack vector
3	The victim performs an interaction such as joining a lobby or accepting content	Confirmed by CVSS and supported by the public demonstration
4	The game processes an attacker-controlled pathname	Strongly implied by the CWE-23 classification
5	The pathname resolves outside the intended directory	Definition of relative path traversal
6	A malicious file is placed in an unexpected location	Reported by Rapid7
7	The destination or subsequent loading behavior gives the file execution semantics	Required to explain the confirmed RCE impact, but exact mechanism is not public
8	Code runs in the current security context	Confirmed potential impact
9	Post-exploitation actions occur	Possible after RCE, but not part of the publicly documented CVE mechanism

Stage one, malicious content preparation

The attacker needs content that reaches the vulnerable path-handling operation. It may involve a scenario, user-generated-content package, synchronized lobby asset, mod, campaign, archive entry, or another game-supported content object.

Rapid7 specifically referred to a malicious game scenario file. Public reporting connected the demonstration to content accepted after joining a lobby. These sources support a game-content attack path, but they do not expose enough details to identify the exact internal file format with certainty. (Rapid7)

Stage two, network delivery

The CVSS attack vector is AV:N. The attacker does not need local access to the victim’s machine. The malicious input can reach the vulnerable component through a network-mediated workflow.

“Network” does not mean that any Internet host can send a single unauthenticated packet directly to a listening service and obtain code execution. The required user interaction indicates an application workflow between remote delivery and exploitation.

Stage three, user interaction

The CVSS vector includes UI:R. A victim must take an action.

The public demonstration involved joining an attacker-controlled lobby and accepting content. Depending on configuration and workflow, the acceptance step may be explicit, automatic after an earlier choice, or presented as a normal requirement for the match. Public information is not detailed enough to define every interface state.

User interaction reduces opportunistic scanning potential, but it does not make the flaw low risk. Social engineering can be especially effective when the requested action appears normal:

• Join a multiplayer lobby.
• Download the map used by the host.
• Synchronize a required mod.
• Accept a custom scenario.
• Open content shared by a community member.

The victim does not need to knowingly run an executable. They interact with content that the game is expected to handle safely.

Stage four, path escape

The game receives or derives a pathname from untrusted content. If the final path is not correctly constrained, a relative sequence can escape the content directory.

The vulnerable pattern may resemble this conceptual operation:

destination = content_root + external_member_name
write(destination, external_bytes)

The secure decision cannot be made by examining external_member_name alone. It must be made on the final canonical destination.

Stage five, unexpected file placement

Rapid7 states that successful exploitation can place malicious files in unexpected locations. That description matches the integrity consequences of CWE-23. (Rapid7)

File-placement risk depends on the permissions of the game process. If the game runs as a standard user, the attacker generally inherits the locations writable by that user. That still includes areas capable of supporting user-level persistence, code loading, data modification, and credential theft after execution.

Running the game as an administrator would increase the damage available to any successful exploit. There is rarely a legitimate reason to grant a multiplayer game administrative privileges for normal use.

Stage six, transition to execution

A path traversal primitive becomes RCE when the planted file is loaded or executed.

Common patterns in other products include:

• Writing a binary into an autostart location.
• Planting a DLL in a directory searched by a trusted executable.
• Overwriting a script or configuration that is later interpreted.
• Writing a plugin into an automatically enumerated directory.
• Placing a shortcut or command file into a logon-processed location.
• Overwriting application content that influences a later execution path.

No public source cited here identifies which pattern Microsoft fixed. Defenders should look broadly for file creation followed by execution rather than building detections around an invented destination.

Understanding the CVSS score

The 8.8 score is high because the consequence can be full code execution with high confidentiality, integrity, and availability impact. The score remains below the common 9.8 critical pattern because user interaction is required.

Attack vector is network

AV:N indicates that the vulnerable operation can be reached through network-delivered input. The attacker does not need to touch the device physically or execute a local utility first.

For CVE-2026-50663, the likely network context is an application-level multiplayer or content-delivery workflow, not an exposed operating-system service.

Attack complexity is low

AC:L means Microsoft did not identify an unusual race condition, narrow timing window, or complex precondition as necessary for exploitation.

It does not mean that writing a working exploit requires no research. CVSS measures environmental preconditions, not researcher effort.

No privileges are required

PR:N indicates that the attacker does not need privileges on the victim device.

This metric does not necessarily mean the attacker can remain completely anonymous to every surrounding service. A multiplayer account may be involved. The CVSS metric concerns privileges on the vulnerable target.

User interaction is required

UI:R is the main limiting factor. The victim must perform an action that brings malicious content into the processing path.

Organizations should not discount UI-required vulnerabilities automatically. Opening an attachment, joining a meeting, importing a project, installing a mod, or entering a lobby can all be ordinary business or user behavior.

Scope is unchanged

S:U indicates that the security authority affected by exploitation remains within the vulnerable component’s authorization scope. Code execution as the current user can still compromise browser sessions, locally stored credentials, source code, documents, SSH keys, cloud tokens, and enterprise data available to that user.

High impact across all three categories

C:H/I:H/A:H means Microsoft assesses the potential effect as high for:

• Confidentiality: the attacker may access data available to the compromised user.
• Integrity: the attacker may modify files, settings, or data.
• Availability: the attacker may disrupt applications or the system.

The vector supports treating successful exploitation as an endpoint compromise, not as a corrupted game save.

Exploitation Less Likely does not mean safe

Microsoft’s July 14 assessment listed CVE-2026-50663 as “Exploitation Less Likely” and not publicly disclosed before the update. On July 15, a researcher publicly demonstrated an attack path. CISA’s time-stamped SSVC data recorded exploitation as none and automation as no, while classifying technical impact as total. (Rapid7)

Those statements can coexist:

• Microsoft may consider broad exploitation unlikely because a victim must join an attacker-influenced workflow.
• A researcher can still demonstrate reliable exploitation in a controlled environment.
• CISA can report no known exploitation at a specific time.
• The technical impact can still be total if exploitation succeeds.
• Public exploit knowledge can change after the vendor’s initial assessment.

Prioritization should combine exploitability and asset context.

A personal gaming PC with no enterprise access is different from a developer workstation containing production credentials. A machine used by a domain administrator, cloud engineer, security researcher, or cryptocurrency operator deserves higher urgency because code execution in that user context exposes more valuable data.

Patch validation for individual users

Fully exit the game

Do not update while assuming an already running process will automatically replace itself. Exit the game and confirm that it is no longer present in Task Manager.

A store client may download new files while an old game process remains active. The new files protect the next launch, not the process already in memory.

Identify the distribution channel

Determine whether the installed copy comes from:

• Steam.
• Microsoft Store.
• Xbox App for Windows.
• Another officially supported channel.

A user may own the game through more than one service or retain an older installation on another drive.

Force an update check

For Steam:

1. Open Steam.
2. Open Library.
3. Select Downloads.
4. Start the pending Age of Empires II update if it did not start automatically.
5. Review the game’s update settings and confirm that downloads are not paused.

For Microsoft Store:

1. Open Microsoft Store.
2. Open the library or downloads area.
3. request available updates.
4. Confirm that the game update completes without an error.

For Xbox App:

1. Open the Xbox App.
2. Select the installed game.
3. Use Update if shown.
4. If necessary, open Manage and check the Files section for updates.

These flows align with the official Update 177723 instructions. (Age of Empires / World’s Edge Studio)

Verify the build inside the game

Launch the game after updating. The official Update 177723 page states that the title screen should show Build 177723.

Record the value exactly. A screenshot is useful for audit or support evidence.

A build greater than 177723 may be expected because later minor updates exist. Do not downgrade simply to obtain an exact match. The goal is to establish that the running copy is not older than the security-relevant release.

Collect the full version when available

The CVE record defines the vulnerable boundary as versions below 101.103.46651.0. If Windows file properties, package inventory, or endpoint tooling exposes a full ProductVersion, capture it.

Use the full version as an additional control:

ProductVersion >= 101.103.46651.0

Do not reject an installation solely because the user interface displays only the shorter Build 177723. The two values come from different public interfaces.

Check for duplicate installations

Search all authorized game-library locations, including secondary disks.

Common causes of duplicate copies include:

• A previous Steam library.
• A Microsoft Store copy retained after moving to Steam.
• A backup restored to another disk.
• A cloned Windows installation.
• A test or mod-development environment.
• Multiple user profiles.
• A shared family computer.

The copy launched by a desktop shortcut may not be the copy inspected manually.

Restart and validate again

After the update:

1. Restart the store client.
2. Launch the game from the store library rather than an old shortcut.
3. Confirm the title-screen build.
4. Test that multiplayer services still function.
5. Do not use an untrusted lobby as a validation test.

Patch validation should prove that the fixed version is running. It should not attempt to reproduce remote code execution on a personal machine.

PowerShell evidence collection

The following script collects file metadata and a SHA-256 hash for a game executable selected by the operator.

It does not exploit the vulnerability, scan third-party systems, or assume a universal installation path.

$GameExe = Read-Host "Enter the full path to the authorized Age of Empires II executable"

if (-not (Test-Path -LiteralPath $GameExe -PathType Leaf)) {
    throw "The supplied file does not exist: $GameExe"
}

$item = Get-Item -LiteralPath $GameExe
$signature = Get-AuthenticodeSignature -LiteralPath $GameExe
$hash = Get-FileHash -Algorithm SHA256 -LiteralPath $GameExe

$result = [pscustomobject]@{
    CollectedAtUtc  = (Get-Date).ToUniversalTime().ToString("o")
    ComputerName    = $env:COMPUTERNAME
    UserName        = "$env:USERDOMAIN\$env:USERNAME"
    Path            = $item.FullName
    ProductVersion  = $item.VersionInfo.ProductVersion
    FileVersion     = $item.VersionInfo.FileVersion
    CompanyName     = $item.VersionInfo.CompanyName
    LastWriteTimeUtc = $item.LastWriteTimeUtc.ToString("o")
    SignatureStatus = $signature.Status
    SignerSubject   = $signature.SignerCertificate.Subject
    SHA256          = $hash.Hash
}

$result | Format-List

$exportPath = Join-Path $env:TEMP "aoe2-cve-2026-50663-evidence.json"
$result | ConvertTo-Json -Depth 3 | Set-Content -LiteralPath $exportPath -Encoding UTF8

Write-Host "Evidence written to: $exportPath"

Interpret the output carefully.

ProductVersion

If a full version is available, compare it numerically with 101.103.46651.0. String comparison can produce incorrect results when components have different digit lengths.

A simple comparison helper is:

function Convert-ToVersionParts {
    param([Parameter(Mandatory)][string]$VersionText)

    $numbers = [regex]::Matches($VersionText, '\d+') |
        ForEach-Object { [int64]$_.Value }

    if ($numbers.Count -lt 1) {
        throw "No numeric version components were found in: $VersionText"
    }

    while ($numbers.Count -lt 4) {
        $numbers += 0
    }

    return ,$numbers[0..3]
}

function Compare-VersionParts {
    param(
        [Parameter(Mandatory)][int64[]]$Left,
        [Parameter(Mandatory)][int64[]]$Right
    )

    for ($i = 0; $i -lt 4; $i++) {
        if ($Left[$i] -lt $Right[$i]) { return -1 }
        if ($Left[$i] -gt $Right[$i]) { return 1 }
    }

    return 0
}

$observed = Convert-ToVersionParts -VersionText $item.VersionInfo.ProductVersion
$fixed    = Convert-ToVersionParts -VersionText "101.103.46651.0"

switch (Compare-VersionParts -Left $observed -Right $fixed) {
    -1 { Write-Warning "The observed full version is below the CVE fixed boundary." }
     0 { Write-Host "The observed full version equals the CVE fixed boundary." }
     1 { Write-Host "The observed full version is above the CVE fixed boundary." }
}

File metadata can vary by binary, package, and storefront. Treat the game’s own build display and official package state as primary evidence, with executable metadata as corroboration.

SHA-256

The hash is useful for:

• Comparing endpoints inside the same organization.
• Preserving incident evidence.
• Detecting an unexplained binary change.
• Confirming that a repaired installation replaced an earlier file.

It is not automatically a vendor-approved known-good indicator. The cited Microsoft sources do not publish a universal SHA-256 allowlist for the fixed game package, and different storefront builds may legitimately have different hashes.

Signature status

A valid Microsoft-related signature supports package integrity, but it does not prove that the version is fixed. Old vulnerable binaries can still be correctly signed.

Security validation needs both provenance and version:

Trusted publisher + fixed version + expected installation channel

Enterprise validation

Games are often excluded from enterprise vulnerability-management programs because they are not considered business applications. CVE-2026-50663 shows why that assumption can create a blind spot.

Potential enterprise exposure includes:

• Personally owned devices with corporate access.
• Developer workstations used for both work and gaming.
• Security-research systems containing API keys and test credentials.
• Shared systems in universities or training facilities.
• Esports, media, streaming, or game-development environments.
• Computers used by privileged administrators outside work hours.
• Lab systems connected to internal networks.
• Unmanaged endpoints enrolled only in identity or email services.

Discover installations

Use approved inventory sources rather than broad unauthenticated scanning.

Useful sources include:

• Endpoint software inventory.
• EDR file search.
• Steam or Microsoft Store package records.
• Installed-app inventories.
• Configuration-management databases.
• User-submitted device attestations.
• Approved file-system searches on managed assets.

Search logic should account for multiple disks and storefronts. Product names, package names, executable names, and paths may differ, so no single indicator should be treated as complete.

Classify results

Status	Decision rule	Required action
Confirmed patched	Running build is 177723 or later and available full version is at least 101.103.46651.0	Retain evidence and monitor
Likely patched	Running build is later than 177723 but full version is unavailable	Record storefront and build, then perform a secondary package check
Inconclusive	Game is installed but build cannot be determined	Force update or reinstall from an official channel
Confirmed vulnerable	Full version is below 101.103.46651.0 or title-screen build predates 177723	Update immediately and assess prior exposure
Not installed	No reliable installation evidence	Close after documenting inventory coverage
Historical exposure	Now patched, but untrusted multiplayer content was used before updating	Perform targeted threat hunting

Prioritize by user context

Two vulnerable installations do not necessarily carry equal organizational risk.

Raise priority when the endpoint belongs to:

• A domain administrator.
• A cloud administrator.
• A developer with code-signing access.
• A security engineer with production credentials.
• A finance or cryptocurrency user.
• An executive with sensitive communications.
• A user exempted from application-control policies.
• A device with weak separation between personal and corporate activity.

The CVSS score represents technical severity. Asset context determines operational priority.

Preserve reproducible evidence

A useful validation record should contain:

Asset identifier
Primary user
Distribution channel
Installation path
Title-screen build
ProductVersion
FileVersion
SHA-256
Signature status
Collection timestamp
Update timestamp
Exposure history
Investigation status
Analyst

Screenshots alone are weak evidence because they can become detached from the device and collection time. File metadata alone is also incomplete. Combine user-interface evidence, endpoint telemetry, and package inventory.

Teams using Penligent or another authorized AI-assisted validation workflow can encode these checks as a controlled retest rather than asking an agent to run an unknown public exploit. The safer pattern is to collect version evidence, compare it with the vendor boundary, search for suspicious file and process behavior, and produce a report that another analyst can reproduce.

Penligent’s published safe AI pentesting workflow similarly emphasizes a clean environment, tight scope, current CVE validation, manual review for high-risk actions, and reproducible evidence. For this vulnerability, automation should support inventory and investigation; it should not turn a multiplayer exploit demonstration into a production test. (Penligent)

A safe path traversal PoC

The following demonstration explains the vulnerability class without interacting with Age of Empires, a network service, a real game directory, or an executable payload.

It runs entirely inside a temporary local laboratory directory. The “escaped” file remains inside that temporary directory and contains only a text marker.

Safety boundary

This PoC:

• Does not target Age of Empires II.
• Does not verify whether a particular game build is vulnerable.
• Does not create an executable.
• Does not write to a startup directory.
• Does not use a real user profile.
• Does not connect to a network.
• Does not reproduce the Microsoft exploit chain.
• Deletes its temporary laboratory when the script exits.

Its purpose is to show why checking the final resolved path is essential.

from __future__ import annotations

import tempfile
from pathlib import Path
from typing import Mapping


def vulnerable_extract(
    extraction_root: Path,
    entries: Mapping[str, bytes],
) -> list[Path]:
    """
    Educationally unsafe extractor.

    It directly joins an externally controlled member name to the
    extraction root without checking the final resolved destination.
    """
    written: list[Path] = []

    for member_name, content in entries.items():
        destination = extraction_root / member_name
        destination.parent.mkdir(parents=True, exist_ok=True)
        destination.write_bytes(content)
        written.append(destination)

    return written


def safe_destination(extraction_root: Path, member_name: str) -> Path:
    """
    Resolve a candidate destination and require it to remain below
    the approved extraction root.
    """
    root = extraction_root.resolve()

    candidate_path = Path(member_name)

    if candidate_path.is_absolute():
        raise ValueError(f"Absolute paths are not allowed: {member_name!r}")

    destination = (root / candidate_path).resolve()

    if destination != root and root not in destination.parents:
        raise ValueError(
            f"Path escapes the extraction root: {member_name!r}"
        )

    return destination


def safe_extract(
    extraction_root: Path,
    entries: Mapping[str, bytes],
) -> list[Path]:
    """
    Minimal safe-pattern demonstration.

    Production extractors also need protections for symbolic links,
    reparse points, race conditions, file types, size limits, and
    platform-specific path behavior.
    """
    written: list[Path] = []

    for member_name, content in entries.items():
        destination = safe_destination(extraction_root, member_name)
        destination.parent.mkdir(parents=True, exist_ok=True)
        destination.write_bytes(content)
        written.append(destination)

    return written


def main() -> None:
    entries = {
        "maps/example.txt": b"normal content\n",
        "../escaped-marker.txt": b"harmless traversal marker\n",
    }

    with tempfile.TemporaryDirectory(prefix="path-traversal-lab-") as lab:
        lab_root = Path(lab)
        vulnerable_root = lab_root / "vulnerable" / "content"
        safe_root = lab_root / "safe" / "content"

        vulnerable_root.mkdir(parents=True)
        safe_root.mkdir(parents=True)

        print(f"Laboratory root: {lab_root}")
        print("\nRunning the intentionally vulnerable extractor...")

        vulnerable_written = vulnerable_extract(vulnerable_root, entries)

        for path in vulnerable_written:
            print(f"Reported path: {path}")
            print(f"Resolved path: {path.resolve()}")

        escaped_marker = lab_root / "vulnerable" / "escaped-marker.txt"

        print(
            "\nDid the traversal marker escape the intended "
            f"content directory? {escaped_marker.exists()}"
        )

        print("\nRunning the safer extractor...")

        try:
            safe_extract(safe_root, entries)
        except ValueError as exc:
            print(f"Blocked unsafe member: {exc}")

        print(
            "\nThe demonstration stayed inside the temporary "
            "laboratory and created no executable content."
        )


if __name__ == "__main__":
    main()

Expected output resembles:

Laboratory root: C:\Users\User\AppData\Local\Temp\path-traversal-lab-...

Running the intentionally vulnerable extractor...
Reported path: ...\vulnerable\content\maps\example.txt
Resolved path: ...\vulnerable\content\maps\example.txt
Reported path: ...\vulnerable\content\..\escaped-marker.txt
Resolved path: ...\vulnerable\escaped-marker.txt

Did the traversal marker escape the intended content directory? True

Running the safer extractor...
Blocked unsafe member: Path escapes the extraction root: '../escaped-marker.txt'

The demonstration stayed inside the temporary laboratory and created no executable content.

What the PoC proves

It proves that concatenating a trusted root with an untrusted relative path does not guarantee containment. The operating system resolves the final path after the application performs the join.

It also shows that the security check must use the resolved destination:

destination = (root / member_name).resolve()

The application then verifies that the trusted root is an ancestor of the destination.

What the PoC does not prove

It does not prove:

• Which Age of Empires component was vulnerable.
• Which filename syntax the game accepted.
• Which directory an actual exploit targeted.
• Whether a specific unpatched installation can be exploited.
• How the public RCE demonstration triggered code loading.
• Whether symbolic links or other Windows path features were involved.

Version validation is the safe way to determine exposure. An exploit attempt is not required.

Why the sample is not a complete production extractor

The safe function demonstrates one boundary check, but production code requires more.

A secure implementation should also address:

• Symbolic links created earlier in the extraction.
• Windows junctions and reparse points.
• Time-of-check to time-of-use races.
• Hard links.
• Reserved device names.
• UNC and device path prefixes.
• Alternate data streams.
• Case-insensitive path comparisons.
• Unicode normalization.
• Duplicate archive entries.
• File overwrite policy.
• Maximum decompressed size.
• Maximum file count.
• Nested archives.
• File extension and magic-byte validation.
• Executable-content restrictions.
• Cleanup after partial failure.

The strongest architecture extracts into a newly created directory owned by a low-privilege process, verifies the complete result, and only then publishes approved content into the application’s active content store.

Detection engineering

Because Microsoft has not published a complete exploit chain or IOC set, behavior-based detection is more useful than searching for a single filename.

A practical detection strategy should correlate:

1. Age of Empires II activity.
2. Receipt or processing of multiplayer or community content.
3. File creation outside expected game-content directories.
4. Creation of executable or script-capable files.
5. A new process or module load shortly afterward.
6. Persistence, credential access, or command-and-control behavior.

File creation from the game process

Monitor files created or overwritten by the game process.

High-value destination classes include:

• User Startup folders.
• %APPDATA%.
• %LOCALAPPDATA%.
• %TEMP%.
• User Downloads.
• PowerShell profile locations.
• Script directories.
• Browser extension directories.
• Application plugin directories.
• User-writable directories in a DLL search path.
• Scheduled-task or service-related locations.
• Game directories not normally modified during content synchronization.

High-value file types include:

.exe
.dll
.scr
.com
.cpl
.msi
.bat
.cmd
.ps1
.vbs
.js
.jse
.wsf
.hta
.lnk

Do not limit detection to those extensions. Code execution can also involve configuration, project, shortcut, library, or serialized data files.

Process ancestry

Investigate when the game process directly or indirectly starts an unusual child process.

Examples include:

powershell.exe
pwsh.exe
cmd.exe
wscript.exe
cscript.exe
mshta.exe
rundll32.exe
regsvr32.exe
schtasks.exe
wmic.exe
curl.exe
certutil.exe
bitsadmin.exe

The presence of one process is not proof of compromise. Some launchers, overlays, accessibility tools, crash reporters, or mod utilities may create unusual ancestry.

The stronger signal is a sequence:

Game joins lobby
    ->
Game creates new file in unusual path
    ->
New executable or script starts
    ->
Process accesses credentials or makes uncommon network connection

Module loading

A traversal exploit may plant a DLL that is loaded by the game or another trusted process.

Monitor for modules loaded from:

• Temporary directories.
• Download directories.
• Unusual user profile subdirectories.
• Newly created mod directories.
• Paths with misleading extensions.
• Directories not normally associated with the loading process.

Compare module creation time with the start of the multiplayer session.

Sysmon coverage

Microsoft Sysmon provides detailed process, network, file, image-load, and hash telemetry. Event ID 11 records file creation and overwriting, and Microsoft specifically notes its value for monitoring Startup, temporary, and download directories. Sysmon can also record process command lines, parent processes, network connections, image loads, and file hashes. (Microsoft Learn)

A conceptual Sysmon fragment could prioritize executable file creation in sensitive user locations:

<Sysmon schemaversion="4.90">
  <EventFiltering>
    <FileCreate onmatch="include">
      <TargetFilename condition="contains">\Start Menu\Programs\Startup\</TargetFilename>
      <TargetFilename condition="begin with">C:\Users\</TargetFilename>
    </FileCreate>

    <ProcessCreate onmatch="include">
      <ParentImage condition="contains">Age of Empires</ParentImage>
    </ProcessCreate>

    <ImageLoad onmatch="include">
      <ImageLoaded condition="contains">\AppData\Local\Temp\</ImageLoaded>
      <ImageLoaded condition="contains">\Downloads\</ImageLoaded>
    </ImageLoad>
  </EventFiltering>
</Sysmon>

This is a conceptual starting point, not a drop-in production policy.

The first C:\Users\ rule would be far too broad in many environments. A production configuration should identify the actual game image, expected content paths, relevant file extensions, and sensitive destinations. Test in a lab or audit mode before broad deployment.

EDR hunting logic

A vendor-neutral hunt can be expressed as:

Find file creation events where:
    initiating process is the Age of Empires II game process
and:
    destination is outside known game content, cache, save, or log directories
and one of:
    file is executable or script-capable
    file is placed in an autostart location
    file is loaded as a module
    file is executed within 30 minutes

A second hunt can look for process relationships:

Find process creation where:
    ancestor process is the Age of Empires II game process
and:
    child or descendant is a shell, script host, LOLBin, or unsigned binary
and:
    execution occurs near a multiplayer session

A third hunt should look for newly created modules:

Find image load events where:
    loading process is the game or a game-adjacent process
and:
    module was created recently
and:
    module path is user-writable
and:
    signer is absent, invalid, or unexpected

Detection signal matrix

Signal	Why it matters	Common false positives	Investigation
Game writes an executable outside its install or approved content directory	Strong file-planting indicator	Legitimate mod manager or updater	Verify signer, creation source, destination, and subsequent execution
Game writes to Startup	Possible user-level persistence	Rare legitimate behavior	Escalate immediately
Game launches PowerShell or cmd	Possible payload execution	Troubleshooting utility or mod tool	Review command line and parent chain
Newly created DLL loads from Temp	Possible DLL planting	Installer or updater behavior	Compare signer, hash, creation time, and loading process
File creation followed by execution	Connects traversal to code execution	Legitimate update	Validate update provenance and distribution channel
New outbound connection from a game child process	Possible command and control	Overlay, crash reporter, browser	Review destination reputation and process identity
Credential-store access after game activity	Post-exploitation indicator	Security software	Correlate with process ancestry and user session
AppLocker or CFA audit event involving the game	Attempted sensitive write or execution	Legitimate content or update	Review exact file, destination, and publisher

Controlled Folder Access and application control

Microsoft Defender Controlled Folder Access permits trusted applications to modify protected folders while blocking or auditing untrusted changes. Microsoft recommends beginning in Audit Mode to assess operational impact before enforcing blocks. (Microsoft Learn)

CFA may reduce damage if an exploit attempts to alter protected data, but it is not a direct fix for CVE-2026-50663.

Limitations include:

• The target directory may not be protected.
• The game may be treated as trusted.
• The attacker may choose an unprotected execution path.
• CFA does not validate the game’s version.
• A successful exploit may pursue actions unrelated to protected folders.

Application control provides another layer. AppLocker can define rules by publisher, product, filename, version, path, or hash, and it supports audit-only deployment before enforcement. It can restrict unapproved applications, scripts, installers, and DLLs from running. (Microsoft Learn)

Application control can interrupt the transition from arbitrary file write to code execution. It does not prevent the initial path traversal, and overly broad path-based allow rules can preserve the attacker’s execution opportunity.

For example, an allow rule that permits every executable under a user-writable game-content folder would undermine the intended control.

Incident response after suspected exposure

Updating the game closes the known vulnerable path. It does not remove code that may already have been planted or undo actions performed after execution.

Treat a credible exploitation signal as a possible endpoint compromise.

Isolate the endpoint

Disconnect the system from untrusted networks or use EDR isolation.

Preserve enough access for authorized forensic collection. Avoid repeatedly launching the game during triage.

Record the version state

Collect:

• Current title-screen build.
• Full ProductVersion and FileVersion.
• Storefront update history.
• Last update time.
• Installation path.
• Previous file versions from backups or EDR.
• Whether an update occurred after the suspicious session.

A patched current version does not prove the endpoint was patched at the time of exposure.

Build the exposure timeline

Identify:

• Multiplayer sessions.
• Lobby joins.
• Invitations from unknown accounts.
• Content acceptance or synchronization.
• Mod and scenario installation.
• Game process start and stop times.
• File creation around those times.
• New process execution.
• Network connections.
• Security alerts.

Do not rely exclusively on user memory. Correlate it with endpoint and application telemetry.

Preserve suspicious files

For each suspicious file, record:

Full path
File size
Creation time
Modification time
SHA-256
Digital signature
Owner
Access control list
Creating process
First execution time
Network activity

Quarantine through approved tools after evidence collection. Do not double-click an unknown file to determine what it does.

Search persistence locations

Review at least:

• Startup folders.
• Run and RunOnce registry keys.
• Scheduled tasks.
• Services.
• WMI event subscriptions.
• Browser extensions.
• PowerShell profiles.
• Login scripts.
• User shell folders.
• Application plugin paths.
• Recently modified shortcuts.
• DLL search-path locations.

The public CVE record does not confirm persistence behavior. These checks investigate what an attacker could do after code execution.

Assess credential exposure

Code execution in a user session may expose:

• Browser cookies.
• Password-manager sessions.
• SSH keys.
• Cloud CLI credentials.
• Source-control tokens.
• API keys.
• Messaging sessions.
• VPN credentials.
• Remote desktop credentials.
• Cryptocurrency wallets.

Reset credentials based on observed access and asset sensitivity. Where theft cannot be ruled out, rotate high-value tokens rather than waiting for an account takeover.

Rebuild when confidence is low

A clean update may be enough when evidence shows that the vulnerable version was never executed or no untrusted content was encountered.

Reimaging becomes more appropriate when:

• Unknown code executed.
• Persistence is present.
• Security logs were altered.
• Privileged credentials were accessible.
• EDR visibility was incomplete.
• The attacker’s actions cannot be bounded.
• The device handles sensitive production access.

Temporary mitigations

The preferred remediation is to install the fixed game version. Temporary controls can reduce exposure while an update is pending.

Avoid untrusted multiplayer content

Do not join public or unsolicited lobbies from unknown users. Treat requests to synchronize custom content as untrusted.

This reduces the likely delivery opportunity but does not correct the vulnerable code.

Disable or suspend community content

Where operationally possible, pause the use of mods, custom campaigns, scenarios, and other externally sourced content until the update is verified.

Existing content should not be assumed safe solely because it was downloaded earlier.

Run without administrative privileges

Do not run the game as an administrator.

Standard-user execution limits the directories an attacker can normally modify. It does not prevent user-level compromise.

Restrict execution from user-writable directories

Application-control policy can block unsigned or unapproved binaries and scripts from locations such as Temp, Downloads, and selected AppData paths.

Audit the policy before enforcement to identify legitimate launchers, overlays, accessibility software, and game components.

Temporarily block the application on managed devices

Where the game is not approved for business use and cannot be updated immediately, administrators can prevent it from running until validation is complete.

This is particularly reasonable on privileged workstations.

Monitor file activity

Increase EDR or Sysmon visibility for the game process, content directories, and sensitive user locations.

Monitoring is a compensating control, not a guarantee that every exploit attempt will be detected.

Related path and archive vulnerabilities

CVE-2026-50663 belongs to a long-established weakness class. Related CVEs help illustrate why file-placement vulnerabilities deserve attention, but they should not be used as evidence that the Age of Empires flaw has the same implementation or exploitation status.

CVE	Product	Core weakness	Interaction	Known real-world status	Relevance
CVE-2018-1002201	zt-zip	../ archive-entry traversal	Local extraction workflow	No comparable current exploitation claim	Classic Zip Slip arbitrary write
CVE-2025-6218	WinRAR	Crafted archive path traversal leading to RCE	User opens malicious content	Added to CISA KEV in December 2025	Shows interactive path traversal can be operationally exploited
CVE-2023-38831	WinRAR	Crafted ZIP processing executes malicious content disguised around a benign file	User attempts to view a benign-looking file	Exploited in the wild in 2023	Shows that normal content interaction can trigger execution
CVE-2026-50663	Age of Empires II: Definitive Edition	Relative path traversal with network-delivered game content	User interaction required	No confirmed in-wild exploitation in cited July 16 sources	Applies the same trust-boundary problem to multiplayer UGC

CVE-2018-1002201

CVE-2018-1002201 affected zt-zip before version 1.13. An archive entry containing ../ could be mishandled during extraction and written outside the intended destination. NVD identifies it as Zip Slip. (NVD)

Its importance is conceptual. The archive may appear to contain ordinary files, but each member name is also a destination instruction. If the extractor trusts that destination, the archive author gains unintended file-system authority.

The mitigation is not to strip one suspicious substring. It is to update the affected library and enforce canonical destination containment.

CVE-2025-6218

CVE-2025-6218 is a WinRAR directory traversal vulnerability that can allow remote attackers to execute code after a victim visits malicious content or opens a malicious file. NVD describes crafted paths traversing into unintended directories and records affected WinRAR versions below 7.12 in its configuration analysis. The vulnerability was later added to CISA’s Known Exploited Vulnerabilities catalog. (NVD)

This CVE matters for prioritization because it demonstrates that user-interaction requirements do not prevent path traversal from becoming an operational attack technique.

It does not establish exploitation of CVE-2026-50663. The products, delivery mechanisms, vulnerable implementations, and timelines are different.

CVE-2023-38831

CVE-2023-38831 affected WinRAR before 6.23. A crafted ZIP archive could contain a benign-looking file and a same-named folder holding executable content. When the user attempted to view the benign file, malicious content was processed. NVD states that the vulnerability was exploited in the wild between April and October 2023. (NVD)

The lesson is relevant to game content: the user’s action can appear safe and ordinary. A victim may believe they are opening a map, image, campaign, or scenario rather than authorizing code execution.

Security must be enforced by the content processor, not delegated to the user’s ability to inspect an opaque package.

Secure design for game-content pipelines

A secure user-generated-content pipeline should treat content packages like untrusted software supply-chain inputs.

Accept only constrained relative names

Archive members should be relative to a defined content root.

Reject:

• Absolute paths.
• Drive-letter paths.
• UNC paths.
• Device paths.
• Empty names.
• Names containing prohibited control characters.
• Parent-directory segments.
• Paths exceeding defined depth or length.
• Platform-specific reserved names.

An allowlist is stronger than attempting to enumerate every dangerous spelling.

Normalize once and validate the result

Input should be decoded into a single internal representation before validation. Repeated decoding can cause a value that appeared safe during the first check to become dangerous later.

The final resolved destination, not the raw member name, must remain inside the extraction root.

Conceptually:

root = canonicalize(approved_root)
destination = canonicalize(join(root, untrusted_name))

if not is_descendant(destination, root):
    reject()

The descendant comparison must use file-system-appropriate case and separator rules.

Defend against link-based escape

Even a safe-looking destination can escape if an intermediate directory is a symbolic link, junction, mount point, or reparse point.

Safer options include:

• Extracting into a newly created directory with no preexisting links.
• Refusing link entries.
• Opening directories using handles resistant to path substitution.
• Rechecking containment at file-creation time.
• Avoiding extraction into attacker-writable shared directories.
• Applying platform-specific reparse-point protections.

Separate extraction from activation

A downloaded package should not become active while it is still being extracted.

A better pipeline is:

Download
    ->
Store in isolated staging area
    ->
Verify package metadata
    ->
Extract with containment checks
    ->
Inspect file types and limits
    ->
Validate content schema
    ->
Reject executable or unsupported content
    ->
Publish approved files atomically
    ->
Load only from the approved content store

This separation reduces the chance that a partially extracted package can influence the running application.

Use a low-privilege content worker

The process that handles untrusted content should have the minimum file-system authority needed.

It should not be able to write to:

• Application installation directories.
• Startup locations.
• System directories.
• Browser profiles.
• Credential stores.
• Unrelated user documents.
• General plugin directories.
• Executable search paths.

Sandboxing does not eliminate the need for path validation, but it limits consequences when validation fails.

Restrict file types and semantics

A scenario package should contain only file types required by the scenario format.

Controls can include:

• Extension allowlists.
• Magic-byte validation.
• Content-schema validation.
• Maximum file size.
• Maximum total decompressed size.
• Maximum entry count.
• Compression-ratio limits.
• Nested archive restrictions.
• Rejection of executable formats.
• Rejection of scripts unless explicitly required and sandboxed.
• Rejection of files with execution-related attributes.

Extension checking alone is weak because file contents can contradict the name.

Test malicious path cases

Automated tests should include:

../file
..\file
a/../../file
a\..\..\file
/absolute/file
C:\absolute\file
\\server\share\file
\\?\C:\device-path
mixed/..\separators
encoded parent segments
trailing dot and space variants
case variants
symbolic-link parents
duplicate destination names
very long paths
Unicode-normalization variants

Testing should target the same APIs and file systems used in production.

Fuzz parsers and installers

Content parsers deserve fuzzing even when they process non-executable media. Their output may control file creation, memory allocation, scripting, or object deserialization.

High-value fuzzing targets include:

• Archive-member parsing.
• Manifest parsing.
• Filename normalization.
• Mod dependency handling.
• Lobby synchronization.
• Temporary-content cleanup.
• Cross-platform path conversion.
• Package update logic.

The expected security property is not merely “the parser does not crash.” It should also be impossible for input to escape the allowed content namespace.

Common patch-validation mistakes

Treating it as a Windows cumulative update

CVE-2026-50663 affects a game package. A current Windows operating system does not prove that the game is current.

Trusting the store’s Installed label

“Installed” means the application exists. It does not necessarily mean all pending updates completed.

Verify the running build.

Checking only one path

A stale installation on another disk can remain vulnerable even when the primary copy is updated.

Comparing dates instead of versions

File timestamps can change during copying, restoration, repair, or backup. They are supporting evidence, not a vulnerability boundary.

Comparing version strings lexically

A string comparison can produce incorrect ordering:

"101.103.9.0" > "101.103.46651.0"

Depending on the comparison implementation, lexical sorting may treat 9 as greater than 4. Parse numerical components.

Assuming no alert means no exposure

EDR may not log every file operation, especially when policies were not configured before the event.

Absence of evidence should be interpreted in the context of telemetry coverage.

Running an exploit on a production system

A public demonstration may execute code, create persistence, or leave unknown artifacts. It is unnecessary for patch validation.

Use version checks and a safe local toy demonstration.

Ignoring a UI-required vulnerability

User interaction is a mitigating factor, not a security boundary. Joining lobbies and receiving match content are normal game activities.

Treating Exploitation Less Likely as a remediation waiver

The label does not reduce the confirmed RCE impact. It may influence scheduling among hundreds of vulnerabilities, but a straightforward application update should not be postponed without a strong reason.

Ending the investigation after updating

If suspicious behavior occurred while a vulnerable version was installed, patching prevents future exploitation but does not remove prior compromise.

Recommended action plan

Immediate

• Identify systems running Age of Empires II: Definitive Edition.
• Update through the official distribution channel.
• Verify Build 177723 or a later official build.
• Capture the full ProductVersion when available.
• Stop using untrusted multiplayer or community content until validation completes.
• Prioritize endpoints used by privileged or high-value users.

Within one business day

• Search managed endpoints for old or duplicate installations.
• Hunt for unusual file creation by the game process.
• Review game-related child processes and module loads.
• Investigate suspicious activity around multiplayer sessions.
• Preserve evidence from systems that were active before updating.

Within one week

• Add game and UGC software to application inventory.
• Review whether games are allowed on privileged workstations.
• Test application-control policy against execution from user-writable locations.
• Establish a repeatable store-application patch process.
• Add path-traversal tests to internally developed package handlers.
• Document exception handling for unmanaged or BYOD devices.

Frequently asked questions

What is CVE-2026-50663?

• It is a relative path traversal vulnerability in Age of Empires II: Definitive Edition.
• Microsoft states that an unauthorized network attacker can use it to execute code.
• Microsoft assigned a CVSS 3.1 score of 8.8.
• No prior privileges are required, but user interaction is required.
• The vulnerable range ends before version 101.103.46651.0. (NVD)

Is CVE-2026-50663 a Windows operating system vulnerability?

• No. The assigned vulnerable product is Age of Empires II: Definitive Edition.
• A successful exploit can compromise a Windows computer when the vulnerable game runs there, but that does not make the root cause a generic Windows file-system vulnerability.
• Windows Update history alone is not sufficient evidence of remediation.
• Validate the game package through Steam, Microsoft Store, Xbox App, and the in-game build display.

Which version fixes CVE-2026-50663?

• Microsoft’s CVE record defines versions below 101.103.46651.0 as affected.
• The official Age of Empires Update 177723 page tells users to confirm Build 177723 on the title screen.
• A later official game build should normally include earlier fixes.
• Preserve both the title-screen build and full ProductVersion when available.
• Do not assume that similarly formatted but unrelated version fields are interchangeable. (NVD)

Does exploitation require the victim to open a file?

• Microsoft confirms that user interaction is required but does not publicly define every possible interaction.
• Rapid7 described a malicious scenario file.
• A public demonstration involved joining an attacker-controlled lobby and accepting user-generated content.
• The victim does not necessarily need to knowingly execute a program.
• Normal-looking game-content handling may be the interaction that reaches the vulnerable path. (Rapid7)

Has CVE-2026-50663 been exploited in the wild?

• The CISA ADP entry recorded exploitation as none on July 15, 2026.
• Microsoft’s release-time assessment listed exploitation as less likely.
• Public reporting on July 15 said there was no evidence of successful in-the-wild exploitation.
• A public demonstration nevertheless showed that the vulnerability could be exploited in a controlled scenario.
• Exploitation status is time-sensitive and should be reevaluated as new evidence appears. (NVD)

How can security teams detect possible exploitation?

• Monitor files created by the game process outside expected content, cache, save, and log directories.
• Prioritize executable, DLL, script, shortcut, and autostart-related file types.
• Investigate game processes that launch shells, script interpreters, system utilities, or unsigned programs.
• Correlate file creation with execution, DLL loading, persistence, and new outbound connections.
• Use Sysmon Event ID 11, EDR file telemetry, process ancestry, module-load data, and network events.
• Avoid relying on a single filename because Microsoft has not published a complete IOC set.

Is installing the update enough after suspected exploitation?

• It is enough to close the known vulnerable code path if the fixed version is actually running.
• It is not enough to remove malware or persistence created before the update.
• Isolate and investigate systems showing suspicious file creation or process execution.
• Preserve hashes, paths, timestamps, process trees, and network evidence.
• Rotate sensitive credentials when access or theft cannot be ruled out.
• Rebuild the endpoint when the scope of code execution cannot be established.

Final assessment

CVE-2026-50663 is significant because it connects an ordinary multiplayer activity to a dangerous local capability. A remote participant should be able to provide a map or scenario without gaining control over where files are written on another player’s computer. The relative path traversal breaks that separation.

The practical remediation is straightforward: update Age of Empires II: Definitive Edition through its actual distribution channel and verify the running build. The security work becomes more demanding when a vulnerable system used untrusted multiplayer or community content before it was updated. Those endpoints need behavioral investigation, not merely a green patch status.

The most defensible priority is therefore:

Verify the running version
    ->
Identify pre-patch exposure
    ->
Hunt for unexpected file placement
    ->
Investigate subsequent execution
    ->
Preserve evidence and remediate compromise

The vulnerability may sit inside a video game, but its security boundary is familiar: untrusted network content reaches a privileged local parser, the parser mishandles a path, and an unintended file write becomes code execution. Treat that boundary with the same rigor applied to document viewers, archive utilities, package managers, development tools, and enterprise content-processing systems.