CVE-2026-62908

Windows Backup Engine Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 9th percentile. A vendor fix is available.

CVSS 3.17.0High EPSS percentile9th0.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your organization runs any of these systems: windows 10, windows 11, windows server 2012, windows server 2016, windows server 2019, windows server 2022, windows server 2025, windows server 2012 r2.
Verify your installed Windows build/patch level on each affected machine and compare it to the fixed versions in the MSRC update guide for CVE-2026-62908.
Upgrade/patch each affected machine to the fixed version that matches your Windows edition (exact target versions are listed in the “what to do” section below).
If patching cannot be done immediately, restrict who can run backup/backup-related operations and remove low-level access from untrusted or temporary users until updates are applied.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-62908 is a Windows Backup feature bug where a standard user who can run a backup at the same time as other activity may be able to gain full control—serious for anyone using affected Windows versions, especially if untrusted users already have low-level access.

CVE-2026-62908 is a local elevation-of-privilege issue (race condition) in the Windows Backup Engine where concurrent backup-related execution mishandles shared resources, enabling a low-privileged, authenticated attacker to gain administrative control of the affected Windows system.

If you're affected

Full administrator control
Total compromise of company PC/servers
Ransomware-enabling access
Business disruption from outages

What is it

This vulnerability is like a “timing mistake” in how Windows handles backup work when multiple operations happen at once. If someone already has limited access on your machine, they may be able to use that timing mistake to jump from basic access to full administrator control. Think of it as getting the keys to the building because two doors accidentally open at the same time.

Who is affected

This matters if your business uses any of these Windows versions: windows 10, windows 11, windows server 2012, windows server 2016, windows server 2019, windows server 2022, windows server 2025, windows server 2012 r2. It requires the attacker to already have low-level access rights on the system and to be able to run the relevant backup-related operation; it does not rely on a user clicking anything.

How urgent is it

This is RED because exploitation has been reported in the wild for vulnerabilities addressed in the same August 2026 Patch Tuesday window, and a known advanced actor (Lazarus group) is associated with patch activity. Even though a KEV entry is not listed for this specific CVE, treat this as actively important: the attacker’s starting point is low-level access, so any already-compromised or improperly permissioned user account can be used to escalate.

What to do — in detail

Identify affected systems: list all endpoints and servers running windows 10, windows 11, windows server 2012, windows server 2016, windows server 2019, windows server 2022, windows server 2025, and windows server 2012 r2.
For each machine, check the exact Windows version/build (OS release and patch level). Your IT vendor/management console (e.g., your endpoint management tool) should show the installed build number.
Compare against the fixed versions for CVE-2026-62908, and upgrade any machine that is below them:
- windows 10: fixed in 10.0.14393.9418; 10.0.17763.9115; 10.0.19044.7663; 10.0.19045.7663
- windows 11: fixed in 10.0.22631.7517; 10.0.26100.9106; 10.0.26200.9106; 10.0.28000.2704
- windows server 2016: fixed in 10.0.14393.9418
- windows server 2019: fixed in 10.0.17763.9115
- windows server 2022: fixed in 10.0.20348.5440
- windows server 2025: fixed in 10.0.26100.33222
  (Use the MSRC update guide for CVE-2026-62908 to map your edition/build to the correct target.)
Patch deployment: install the MSRC update for CVE-2026-62908 on a schedule that matches your risk level; prioritize machines where low-level users or contractors have access.
Workaround if delayed: limit which accounts can perform backup-related operations and reduce low-level access for users who do not need it. Also review any recent account additions and ensure local permissions align with least privilege.
Monitoring after patching: look for unusual backup activity patterns, especially concurrent backup execution events on systems where that is not typical for your environment.
Reporting: if you manage systems centrally, confirm patch success across all targeted machines and document remediation for audit/compliance.

Technical context

Severity: high. Weaknesses are listed as CWE-362 (race condition) and CWE-416 (use-after-free class issue is a separate CWE often associated with memory/state handling errors, depending on the detailed implementation). Mechanism: a local attacker with low-level rights can trigger the Windows Backup Engine to perform concurrent operations in a way that improperly synchronizes shared resources, leading to privilege escalation to administrative control. Attack vector is local, with authentication required, and no user interaction needed.

Exploitation status: KEV is not listed for this CVE, but exploitation is reported as YES for vulnerabilities covered in the August 2026 Patch Tuesday window; however, the news summary does not explicitly name CVE-2026-62908 as the exploited zero-day (it highlights other actively exploited items in related entries). There is no public exploit code on record. EPSS is low and flat (prediction only) and should not be treated as a safety guarantee given the broader patch-tuesday exploitation reporting.

What KEV means here: because this CVE is not on CISA KEV, there’s no CISA-confirmed exploitation entry; nonetheless, the traffic-light verdict is RED based on the overall exploitation reporting context and threat-actor association.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS9th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 9th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 5 days, from the signal feeds we watch.

2026-08-16Patch availablerecord updated
2026-08-14Patch availablerecord updated
2026-08-13OpenVAS check added
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.0 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable