CVE-2026-62728

Windows Common Log File System Driver Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 9th percentile. A vendor fix is available.

CVSS 3.17.0High EPSS percentile9th0.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which of these are installed and their OS version: Windows 10, Windows 11, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025.
Verify whether the machine is already updated past these fixed build numbers for your specific Windows version.
Install the Microsoft security update for CVE-2026-62728 from the MSRC update guide.
If you can’t patch immediately, restrict or remove low-privilege accounts that are able to log on to the affected systems, and monitor for unusual privilege changes and suspicious activity around file system actions by non-admin users.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Time-of-check time-of-use (toctou) race condition in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-62728 is a Windows local security bug that lets a normal logged-in user exploit a timing flaw to gain administrator control; if your business has Windows machines with standard user accounts, you should patch.

CVE-2026-62728 is a local privilege escalation due to a time-of-check time-of-use (TOCTOU) race condition in the Windows Common Log File System Driver, where an attacker with a low-privilege account can change a file between the driver’s checks and later use to trick it into granting higher-level access.

If you're affected

Full admin control by insiders
Malware persistence with admin rights
Total compromise of business systems
High operational disruption risk

What is it

This vulnerability is like a “check-then-use” mistake in Windows where the system looks at a file, then later uses it without re-checking that it’s still the same file. If someone with a normal account can time the change just right, they can trick Windows into giving them administrator-level control. That can let attackers (or a careless insider) take over the computer and do almost anything.

Who is affected

This matters if your business uses Windows 10, Windows 11, or affected Windows Server versions listed for CVE-2026-62728. It specifically impacts systems where an attacker can log in as a standard (low-privilege) user account.

It’s a risk on reachable systems in default configuration, and the attacker needs a valid low-privilege account on the machine (no special user interaction is required).

How urgent is it

This is RED because it’s an elevation-of-privilege bug that can turn a normal logged-in account into full administrator control, which is the kind of foothold attackers and insiders value. Even though no public exploit code is recorded and there’s no specific dated CVE incident report here, the patch availability means you should treat this as urgent for any systems that could be accessed by standard users.

What to do — in detail

Confirm exposure

Identify the exact Windows edition and version on each affected machine (Windows 10/11 and the listed Windows Server versions).
Determine the currently installed OS build number (the build number is what the MS fix cards reference).
Compare your build against the fixed builds below for your edition.

Fixed versions to use

Windows 10:
- fixed in 10.0.14393.9418
- fixed in 10.0.17763.9121
- fixed in 10.0.19044.7663
- fixed in 10.0.19045.7663
Windows 11:
- fixed in 10.0.22631.7517
- fixed in 10.0.26100.9168
- fixed in 10.0.26200.9168
- fixed in 10.0.28000.2704
Windows Server 2012:
- fixed in 6.2.9200.26280
Windows Server 2012 R2:
- fixed in 6.3.9600.23338
Windows Server 2016:
- fixed in 10.0.14393.9418
Windows Server 2019:
- fixed in 10.0.17763.9121

Patch guidance

Download and install the Microsoft security update for CVE-2026-62728 using the MSRC update guide.
Reboot if required and re-check the build number to confirm the update is actually installed.

Temporary mitigation if patching is delayed

Reduce the number of standard accounts that can log on to these systems; remove or disable accounts that are not strictly needed.
Treat any “standard user” logins as potentially dangerous until patched—focus on unusual activity from non-admin accounts.
Monitor for signs of privilege changes and suspicious file-system related behavior consistent with attempts to exploit race conditions.

What to monitor after patching

Successful installation and correct OS build verification.
Security logs for unusual actions around file operations by non-admin users.
Any alerts that indicate local privilege escalation attempts.

KEV note

This CVE is not listed in the CISA KEV catalog in the provided findings.

Technical context

CVE-2026-62728 is a local privilege escalation in the Windows Common Log File System Driver. The mechanism is a TOCTOU race condition: the driver checks a file’s state and then later uses it without sufficient protection against changes in between, allowing a low-privilege authenticated attacker to manipulate the timing to obtain higher-level (administrator) access.

In the provided findings, it is reachable in default configuration and requires a valid low-privilege account; no user interaction is required. There is no public exploit code on record, and there is no KEV listing. The provided EPSS prediction is 0.2% with a flat trend, but exploitation status in this dataset is driven primarily by the RED verdict and the patch-focused reporting. The fixed versions are provided per OS branch via MSRC.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS9th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 9th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 5 days, from the signal feeds we watch.

2026-08-16Patch availablerecord updated
2026-08-13OpenVAS check addedpatch available, record updated
2026-08-12Record updatedrecord updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.0 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable