CVE-2026-62708

Windows Kernel Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 25th percentile. A vendor fix is available.

CVSS 3.16.4Medium EPSS percentile25th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-13Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your Windows 11 or Windows Server 2025 systems have been updated past the listed fixed versions.
On Windows 11, upgrade to 10.0.26100.9168 or 10.0.26200.9168, or 10.0.28000.2704, depending on your branch.
On Windows Server 2025, upgrade to 10.0.26100.33296 or 10.0.26100.33222, depending on your branch.
If patching can’t happen right away, treat the affected machines as “physically sensitive” and restrict who can access the hardware (locked rooms, secure desk policies, and screen lock) until updates are applied.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.

In plain language

Written by AI from the record

CVE-2026-62708 is a Windows bug that could let someone with physical access to your PC gain administrator control; if your devices are well-locked down, a typical small business should be less worried, but it still needs patching.

CVE-2026-62708 is a Windows Kernel privilege escalation via a memory-management flaw (a physical-access “steal/own the device” scenario leading to elevated privileges).

If you're affected

Full administrator control
Data theft from the device
Malware installation risk
Business disruption

What is it

This is a Windows security weakness where the operating system’s core has a memory-handling bug. In the worst case, someone who can physically access the computer could use it to take administrator-level control, like turning a locked office door into an unlocked one.

Who is affected

This matters if you run Windows 11 devices or Windows Server 2025 machines. The main risk applies when an attacker can get physical access to the device; in other words, it’s not about a normal internet login.

Because physical access is required, the threat is mostly relevant for machines in areas where someone could walk up to them, plug in hardware, or otherwise gain hands-on control.

How urgent is it

This is a RED item because the vulnerability enables privilege escalation to administrator control, and attackers with physical access can target it without needing credentials first. Even though publicly confirmed exploitation details are not provided here, the reporting indicates this is a new, patch-related development and it needs to be remediated promptly.

Act now to apply the fixed Windows updates and tighten physical access to devices until patching is complete.

What to do — in detail

Confirm exposure

Identify the OS version/build on each affected machine.
- For Windows 11: verify whether the current build is older than the fixed builds listed below.
- For Windows Server 2025: verify whether the current build is older than the fixed builds listed below.
Compare your build number to the fixed versions provided by Microsoft for CVE-2026-62708.

Upgrade to the fixed builds

Windows 11 (pick the correct one that matches your update branch):
- Fixed in 10.0.26100.9168 or 10.0.26200.9168, or 10.0.28000.2704
- Also fixed in 10.0.26100.9106 and 10.0.26200.9106
Windows Server 2025 (pick the correct one that matches your update branch):
- Fixed in 10.0.26100.33296 or 10.0.26100.33222

Where to get the patch

Use the Microsoft Update Guide for CVE-2026-62708: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62708

Temporary workaround (if patching is delayed)

Treat affected systems as “physically sensitive”:
- Keep devices in locked rooms or areas with controlled entry.
- Enforce desk/device lock when unattended.
- Limit who can open hardware access paths or connect external storage.
This matters because the findings specify physical access to the system is required.

What to monitor after updating

After patching, verify updates completed successfully on each host.
If you have any reason to suspect physical tampering (lost/stolen devices, unexpected device downtime), prioritize full incident checks (accounts, new admin users, suspicious software).

Deadline note

No CISA due date was provided for this CVE in the findings.

Technical context

CVE-2026-62708 is a Windows Kernel Elevation of Privilege issue (CWE-416) involving a memory-management error consistent with a use-after-free scenario in the kernel. The attack requirement emphasized in the findings is physical access to the device; authentication/authorization is not required beyond that.

Findings show no KEV listing and no dated, clearly described exploitation reports in the provided news, and no public exploit code on record. EPSS is a low predicted likelihood and flat trend (not used as a driver here because the overall verdict is RED).

Patch availability is confirmed via Microsoft MSRC, with multiple fixed Windows 11 build numbers and Windows Server 2025 build numbers. The PULSE data indicates new patch-related attention and an associated actor reference, so treat this as a real, actionable patch need rather than a purely theoretical issue.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS25th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 25th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 2 days, from the signal feeds we watch.

2026-08-13OpenVAS check addedpatch available, record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US
- Windows 11 Version 24H2OSOn-premOperating Systems / windows
- Windows Server 2025 (Server Core installation)OSOn-premOperating Systems / windows

And 7 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 6.4 by NVD.

How it is reached

Attack Vector PhysicalRequires physical access to the device
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable