CVE-2026-62721 Overview
CVE-2026-62721 is a local privilege escalation vulnerability in the Microsoft Windows User-Mode Power Service (UMPS). The flaw stems from insufficient granularity of access control [CWE-1220] within UMPS. An authorized local attacker can leverage this weakness to elevate privileges on affected systems. The vulnerability affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025. Microsoft published the advisory on August 11, 2026.
Critical Impact
A locally authenticated attacker can escalate to higher privileges, gaining full confidentiality, integrity, and availability impact on the compromised host.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64 editions
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64 editions
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-62721 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-62721
Vulnerability Analysis
The User-Mode Power Service (UMPS) manages power state transitions and related policy operations in Windows. UMPS exposes interfaces that must enforce strict access checks to prevent unauthorized callers from influencing privileged operations. In CVE-2026-62721, the access control checks lack sufficient granularity, allowing a lower-privileged authorized caller to reach operations that should be restricted to higher-privilege contexts.
Exploitation requires local access and low privileges, with no user interaction. A successful attack yields high impact on confidentiality, integrity, and availability, meaning an attacker who lands on the host as a standard user can pivot to SYSTEM-level operations. Given the ubiquity of UMPS across supported Windows builds, the exposure covers virtually the entire modern Windows fleet.
Root Cause
The root cause is mapped to [CWE-1220] Insufficient Granularity of Access Control. UMPS makes authorization decisions at a granularity coarser than the operations it protects. As a result, a caller authorized for one operation can invoke sibling operations that should require a distinct, higher trust level.
Attack Vector
The attack vector is local. An attacker who already has code execution as a standard user on the target Windows system can interact with UMPS through its documented client interfaces and trigger the under-protected operation path. No network exposure or victim interaction is required. This pattern is typical of second-stage tooling used after initial access via phishing, drive-by download, or supply chain compromise.
No public proof-of-concept exploit code is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update Guide for authoritative technical details.
Detection Methods for CVE-2026-62721
Indicators of Compromise
- Unexpected child processes spawned by svchost.exe instances hosting the User-Mode Power Service, particularly processes running as NT AUTHORITY\SYSTEM and initiated from a standard user session.
- Anomalous token manipulation or process integrity level transitions on a host immediately following interaction with power management APIs.
- New scheduled tasks, services, or driver installations created shortly after a low-privilege user session begins.
Detection Strategies
- Hunt for standard user processes issuing RPC or COM calls into the UMPS surface and shortly thereafter obtaining elevated tokens.
- Correlate Windows Security event IDs 4672 (special privileges assigned) and 4688 (process creation) to identify unexpected elevation chains originating from non-administrative accounts.
- Baseline normal UMPS client callers per host and alert on new, uncommon binaries invoking power service interfaces.
Monitoring Recommendations
- Ingest Sysmon process creation, image load, and RPC telemetry into your SIEM and retain long enough to reconstruct multi-stage privilege escalation chains.
- Monitor for the appearance of newly patched Windows binaries after the August 2026 update cycle to confirm patch deployment coverage.
- Watch for privilege escalation techniques mapped to MITRE ATT&CK T1068 (Exploitation for Privilege Escalation) on Windows endpoints.
How to Mitigate CVE-2026-62721
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows client and server builds.
- Prioritize patching multi-user systems, terminal servers, VDI hosts, and developer workstations where standard users routinely execute code.
- Audit local account membership and remove unnecessary interactive logon rights to reduce the pool of accounts that can trigger the flaw.
Patch Information
Microsoft has issued fixes through the standard Windows Update channel for all listed operating systems, including Windows 10 1607, 1809, 21H2, 22H2, Windows 11 23H2, 24H2, 25H2, 26H1, and Windows Server 2012 through 2025. Confirm deployment through your update management tooling and validate build numbers against Microsoft's advisory.
Workarounds
- No official workaround has been published by Microsoft; patching is the supported remediation.
- Enforce least privilege and application control (Windows Defender Application Control or AppLocker) to limit which binaries a standard user can execute against local services.
- Restrict interactive and remote interactive logon on high-value servers to administrative personnel only until patches are validated.
# Verify installed Windows updates on affected hosts (PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
# Confirm the User-Mode Power Service state
Get-Service -Name UserManager, Power | Format-Table -AutoSize
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
