CVE-2026-62772

This is a security weakness in a Windows driver used for container isolation. If someone already has basic access to the computer, they may be able to overwhelm the driver’s handling of data and turn that into full control of the machine. Think of it like a safety guard on a door that can be broken if someone inside the building pushes too hard—after that, they can get past normal protections.

This matters to you if you run Windows 11 on devices where Windows Container Isolation is used (the unionfs.sys file system filter driver is reachable in that setup). It’s primarily a risk for someone who already has local access (low-privilege), and it does not require special user clicks. The risk is gated by local access and by whether this container isolation driver is reachable on your configuration.

This is RED because the bug enables local privilege escalation to full host control, which can quickly turn an ordinary account into system-level access. Even though there are no reported active attacks in dated reporting and no public exploit code on record, you should treat this as a serious patching priority for any Windows 11 machines using container isolation. Patch Tuesday included this fix, so you should move it to the top of your update queue.

Confirm exposure

• Determine whether the device is running Windows 11 with Windows Container Isolation / unionfs.sys reachable.
• Check your OS/build level against the vendor fix requirement: the patch is fixed in Windows 11 10.0.28000.2704.

Upgrade / fix

• Upgrade to Windows 11 build 10.0.28000.2704 or later by installing the Microsoft August 2026 Patch Tuesday update that includes CVE-2026-62772.
• If you manage multiple devices, prioritize those that both (a) use Windows containers/container isolation and (b) have multiple users or any elevated local access risk.

Temporary workaround (if you can’t patch immediately)

• Reduce local access risk: ensure only trusted staff can log on locally with any low-privilege account that could be used to attempt the escalation.
• If container isolation isn’t required for operations, pause/disable container usage on the affected hosts until patching is complete.

After patching

• Monitor for normal post-update stability; since the flaw can involve crashing/corruption via excessive data handling, unexpected reboots or driver-related errors should be investigated.
• Review access logs for unusual local account activity around the time updates were applied.

KEV / timeline

• This CVE is not listed in CISA KEV based on the provided findings, so there is no CISA-driven “already exploited” date to follow from KEV alone.

Summary and severity

• CVE-2026-62772 is a local privilege escalation (CWE-122) in Windows Container Isolation FS Filter Driver (unionfs.sys) on Windows 11.

Mechanism (how it’s triggered)

• An authorized low-privilege user can send excessive data that leads to crash or memory corruption, enabling elevation of privilege to take over the host.

Exploitation status and maturity

• No KEV listing is provided and no dated in-the-wild exploitation claim is reported in the findings.
• No public exploit code is on record (per findings), suggesting exploit availability is not confirmed.

Patch guidance

• The fix is available for Windows 11 and the finding states it is fixed in 10.0.28000.2704.

Predicted likelihood

• EPSS is given as a prediction with a flat trend; however, exploitation confirmation is not provided in KEV/news findings, so the priority is still driven by the high-impact local privilege escalation and the availability of a patch.