CVE-2026-62696

Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 24th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile24th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether the affected Windows Program Compatibility Assistant Service is running on your machines and whether any non-admin users can log in locally.
Identify your exact Windows version/build number (Settings → System → About) for each affected device.
Upgrade/install the Microsoft security update for CVE-2026-62696 so it reaches one of the fixed versions listed below.
Reboot the machines after installation and confirm updates are fully applied.
Review Windows security logs for unusual privilege changes or failed/suspicious local activity around the time of any user logons.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Integer underflow (wrap or wraparound) in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-62696 is a Windows bug that lets a local user with low-level access gain full control of the computer; if you just share PCs or allow non-admin accounts to log in, you should act quickly.

CVE-2026-62696 is an elevation of privilege issue in the Windows Program Compatibility Assistant Service caused by an integer underflow, enabling a local attacker with low-level privileges to gain high-level permissions; the default setup is reachable for exploitation.

If you're affected

Full system takeover
Malware installation with admin power
Ransomware risk
Service disruption

What is it

This is a flaw in a Windows component that helps programs run correctly. If someone has a basic local foothold (not full admin access), they may be able to trigger the bug and jump to full control of the computer—like turning a limited key into a master key.

Who is affected

This matters if your business runs Windows 10, Windows 11, or Windows Server (2016/2019/2022/2025) on machines where an attacker could already have local access with low-level privileges. Exploitation does not require tricking users into clicking anything, and the vulnerability is reachable in default configuration. The key reachability gate is: only a risk if someone can get local access with low-level privileges on the device.

How urgent is it

This is RED because exploitation impact is full control of the system, and the vulnerability is reachable in default configuration once an attacker has local low-level access. While there are no clearly dated public incident reports in the provided sources, patch activity has been reported and the item is new enough to warrant immediate remediation.

What to do — in detail

Confirm likely exposure
- For each device running Windows 10/11 or Windows Server 2016/2019/2022/2025, verify the operating system version/build.
- Determine whether the Windows Program Compatibility Assistant Service exists and is running on the device (it’s a Windows component; most standard installations include it).
- Identify whether non-admin users can obtain local access (for example, shared workstation sign-ins, helpdesk accounts, kiosks, or any user who can log on locally).
Apply the Microsoft fix (target fixed versions)
- Windows 10: update so it is fixed in one of the following builds:
  - 10.0.14393.9418
  - 10.0.17763.9121
  - 10.0.19044.7663
  - 10.0.19045.7663
- Windows 11: update so it is fixed in one of the following builds:
  - 10.0.22631.7517
  - 10.0.26100.9168
  - 10.0.26200.9168
  - 10.0.28000.2704
- Windows Server 2016: fixed in 10.0.14393.9418
- Windows Server 2019: fixed in 10.0.17763.9121
- Windows Server 2022: fixed in 10.0.20348.5499
- Windows Server 2025: fixed in 10.0.26100.33296
Reboot and verify
- Reboot after installing updates.
- Confirm the OS version/build now matches (or is above) the fixed build for your branch.
If you can’t patch immediately (temporary containment)
- Reduce or remove the ability for low-privilege accounts to gain local access on affected machines (tighten local account access and logon permissions).
- Remove unnecessary local user accounts and limit who can sign in locally.
- Focus on devices that are most exposed to local access (front-desk workstations, shared terminals, endpoints with permissive local policies).
What to monitor after the update
- Windows security event logs for privilege escalation-related activity on endpoints.
- Alerts around unusual local behavior shortly after a user logs in (especially on machines with many local users).

Technical context

Severity is high (CVSS 7.8). The weakness is CWE-191 (Integer Underflow). The attack is local: an attacker needs low-level local access, then can trigger an integer underflow in the Windows Program Compatibility Assistant Service to elevate privileges to full control. The provided sources indicate the vulnerability is reachable in default configuration and requires no user interaction.

KEV (CISA Known Exploited Vulnerabilities) is not listed in the provided findings, and there is no clear dated press claim of exploitation. No public exploit code is noted in the provided sources. EPSS is given as 3.2% with a flat trend, but because KEV/news exploitation is not confirmed in the findings, EPSS is informational rather than determinative here. The “PULSE” data notes press attention tied to patch activity and mentions the Lazarus group as the actor behind the attention, but the findings do not provide a dated exploitation confirmation.

For business risk, the practical gate is local access with low-level privileges on affected Windows versions; once that is present, the consequence is full system compromise potential.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS24th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 24th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 5 days, from the signal feeds we watch.

2026-08-16Patch availablerecord updated
2026-08-13OpenVAS check addedpatch available, record updated
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US

And 22 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable