CVE-2026-62721

Windows has a built-in power-related service called the User-Mode Power Service (UMPS). This flaw weakens how Windows decides who is allowed to do what inside that service, so a person who already has local access on the machine may be able to climb to higher privileges—like turning a limited account into something closer to full control. If that happens, it can make it easier for malware to take over or stay hidden.

This matters if you run Microsoft Windows desktop or server editions listed (Windows 10, Windows 11, and Windows Server 2012/2016/2019/2022/2025, plus Windows Server 2012 R2). The risk is mainly for machines where an attacker already has some local access, because the vulnerability requires an authorized local attacker rather than being a simple internet-to-admin bypass. In other words, you should focus on patching the affected machines, especially those exposed to common entry points like stolen credentials, remote desktop access, or malware already present.

VERDICT: RED. The vulnerability is a local elevation-of-privilege issue, which means it becomes serious when an attacker already has a foothold on a device—then they can raise privileges and broaden the damage. Microsoft has fixes available, and press attention is pointing to a fresh patch cycle, so prioritize deployment of the available updates on all affected systems.

1. Identify scope (which systems are affected):

   • List your endpoints/servers running: Windows 10, Windows 11, Windows Server 2012 R2, and Windows Server 2012/2016/2019/2022/2025.
   • For each system, capture its current OS build number.

2. Confirm whether each machine is already patched:

   • Apply these “fixed in” build thresholds from the MSRC update guide for CVE-2026-62721:
     • Windows 10 fixed in:
       • 10.0.14393.9418
       • 10.0.17763.9115
       • 10.0.19044.7663
       • 10.0.19045.7663
     • Windows 11 fixed in:
       • 10.0.22631.7517
       • 10.0.26100.9106
       • 10.0.26200.9106
       • 10.0.28000.2704
     • Windows Server 2016 fixed in:
       • 10.0.14393.9418
     • Windows Server 2019 fixed in:
       • 10.0.17763.9115
     • Windows Server 2022 fixed in:
       • 10.0.20348.5440
     • Windows Server 2025 fixed in:
       • 10.0.26100.33222
   • If a machine’s build is below the corresponding “fixed in” build, it is not fully addressed by the vendor fix.

3. Patch with the vendor update:

   • Go to Microsoft’s MSRC update guide for CVE-2026-62721 and install the update that matches your OS/version.
   • After installing, reboot to ensure the update is active.

4. Temporary containment if patching is delayed:

   • Reduce the chance of attackers obtaining local access: review and tighten access paths (for example, remote access methods and credential exposure).
   • If you have incident or endpoint detection tooling, prioritize hunting for signs of local compromise on unpatched machines (the main risk driver here is an attacker already being locally present).

5. What to monitor after patching:

   • Confirm the OS build number changed to the patched level after reboot.
   • Monitor for unusual privilege-related activity on the updated systems (especially events indicating privilege elevation), as a sanity check that compromise attempts aren’t continuing.

6. Exploit status note:

   • There is no public exploit code recorded in the findings, and there is no KEV listing. However, press attention indicates a new patch cycle, so treat this as urgent for patch coverage on affected systems.

CVE-2026-62721 is an elevation of privilege flaw (CWE-1220) in Windows User-Mode Power Service (UMPS). The mechanism described in the findings indicates insufficient granularity of access control: a local attacker who is already authorized can use overly permissive access decisions inside UMPS to gain higher privileges. The provided traffic-light verdict is RED.

In the findings: KEV is not listed in CISA KEV and there is no public exploit code on record. EPSS is only a prediction and is flat/trending (the findings do not support using it as an urgency rationale in public-facing guidance). Press attention (via PULSE) notes this is a new patch and mentions an actor reference (Lazarus group), but the findings do not include confirmed exploitation or KEV.

Attack vector, based on the vulnerability description and access model: local, after an attacker has some level of authorized local access (not a simple unauthenticated internet trigger). KEV being absent means confirmed wide exploitation is not indicated by that specific mechanism in the provided data.