Medium · 5.5 CVE-2026-62687 EUVD-2026-99839GHSA-99cv-qr86-89xq

Windows Backup Engine Information Disclosure Vulnerability

Published Oct 13, 2026 · Updated Nov 10, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Windows 10 Version 21H2 Product: Windows 10 Version 22H2 Product: Windows 11 version 23H2 Product: Windows 11 Version 24H2 Product: Windows 11 Version 25H2 Product: Windows 11 version 26H1 Product: Windows 11 Version 26H2 Platform: Windows

Description

Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to disclose information locally.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Windows 10 Version 21H2	10.0.19044.0 – < 10.0.19044.7807	10.0.19044.7807
Microsoft	Windows 10 Version 22H2	10.0.19045.0 – < 10.0.19045.7807	10.0.19045.7807
Microsoft	Windows 11 version 23H2	10.0.22631.0 – < 10.0.22631.7652	10.0.22631.7652
Microsoft	Windows 11 Version 24H2	10.0.26100.0 – < 10.0.26100.9711	10.0.26100.9711
Microsoft	Windows 11 Version 25H2	10.0.26200.0 – < 10.0.26200.9711	10.0.26200.9711
Microsoft	Windows 11 version 26H1	10.0.28000.0 – < 10.0.28000.3231	10.0.28000.3231
Microsoft	Windows 11 Version 26H2	10.0.26300.0 – < 10.0.26300.9711	10.0.26300.9711

Advisories 2

WID-SEC-2026-3892 Microsoft Windows und Windows Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
MSRC-CVE-2026-62687 Windows Backup Engine Information Disclosure Vulnerability Microsoft Security Response Center · Oct 13, 2026

References

Windows Backup Engine Information Disclosure Vulnerability vendor-advisory patch