CVE-2026-62721
Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally.
CVSS score7.8 / 10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-1220
Vendorsmicrosoft
Affected products
| Vendors | Product | Versions |
|---|---|---|
| microsoft | windows 10 1607 | < 10.0.14393.9418 |
| microsoft | windows 10 1809 | < 10.0.17763.9115 |
| microsoft | windows 10 21h2 | < 10.0.19044.7663 |
| microsoft | windows 10 22h2 | < 10.0.19045.7663 |
| microsoft | windows 11 23h2 | < 10.0.22631.7517 |
| microsoft | windows 11 24h2 | < 10.0.26100.9106 |
| microsoft | windows 11 25h2 | < 10.0.26200.9106 |
| microsoft | windows 11 26h1 | < 10.0.28000.2704 |
| microsoft | windows server 2012 | - |
| microsoft | windows server 2016 | < 10.0.14393.9418 |
| microsoft | windows server 2019 | < 10.0.17763.9115 |
| microsoft | windows server 2022 | < 10.0.20348.5440 |
| microsoft | windows server 2025 | < 10.0.26100.33222 |
Related articles
Windows Server 2016 security updates end in January 2027
Windows Server 2016 security updates end in January 2027
Azure AI Foundry Authentication Failure Earns Maximum-Severity CVSS Rating
Microsoft mitigated CVE-2026-85889, a CVSS 10.0 auth flaw in Azure AI Foundry allowing remote privilege escalation, plus Copilot and Azure bugs.
This product uses the NVD API but is not endorsed or certified by the NVD.