High · 7.8 Exploitation more likely Publicly disclosed CVE-2026-62832 EUVD-2026-56678GHSA-mwg8-c87h-qx3q

Windows User Profile Service Elevation of Privilege Vulnerability

Published Aug 11, 2026 · Updated Nov 10, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Windows 10 Version 21H2 Product: Windows 10 Version 22H2 Product: Windows 11 version 23H2 Product: Windows 11 Version 24H2 Product: Windows 11 Version 25H2 Product: Windows 11 version 26H1 Product: Windows Server 2022 Product: Windows Server 2025 Product: Windows Server 2025 (Server Core installation) Platform: Windows

Description

Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Windows 10 Version 21H2	10.0.19044.0 – < 10.0.19044.7663	10.0.19044.7663
Microsoft	Windows 10 Version 22H2	10.0.19045.0 – < 10.0.19045.7663	10.0.19045.7663
Microsoft	Windows 11 version 23H2	10.0.22631.0 – < 10.0.22631.7517	10.0.22631.7517
Microsoft	Windows 11 Version 24H2	10.0.26100.0 – < 10.0.26100.9168	10.0.26100.9168
Microsoft	Windows 11 Version 25H2	10.0.26200.0 – < 10.0.26200.9168	10.0.26200.9168
Microsoft	Windows 11 version 26H1	10.0.28000.0 – < 10.0.28000.2704	10.0.28000.2704
Microsoft	Windows Server 2022	10.0.20348.0 – < 10.0.20348.5499	10.0.20348.5499
Microsoft	Windows Server 2025	10.0.26100.0 – < 10.0.26100.33296	10.0.26100.33296
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0 – < 10.0.26100.33296	10.0.26100.33296

Advisories 3

WID-SEC-2026-2756 Microsoft Windows Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 30, 2026
NCSC-2026-0284 Kwetsbaarheden verholpen in Microsoft Windows NCSC-NL (Netherlands) · Aug 11, 2026
MSRC-CVE-2026-62832 Windows User Profile Service Elevation of Privilege Vulnerability Microsoft Security Response Center · Aug 11, 2026

References

Windows User Profile Service Elevation of Privilege Vulnerability vendor-advisory patch