CVE-2026-62832

CVE-2026-62832 is a local privilege escalation flaw (CWE-59, improper link resolution, or 'link following') in the Windows User Profile Service. An attacker who already holds a limited local account on an affected machine can cause the service to follow a symbolic link or junction before it validates file access, so the service performs file operations with elevated rights. Successful exploitation grants elevated privileges on the local system — typically up to administrator/SYSTEM level — with no user interaction required. Affected platforms include Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H1, and Windows Server 2022 and 2025, which together span essentially the entire supported Windows estate. As of this analysis there is no public proof-of-concept, no CISA KEV listing, and no confirmed in-the-wild exploitation of this specific flaw; EPSS estimates a 3.3% (88th percentile) chance of exploitation within 30 days, although Microsoft's August 2026 Patch Tuesday fixed 400+ vulnerabilities and a separate zero-day (CVE-2026-68820) is under active attack.

What to do: Apply the Microsoft cumulative security update addressing CVE-2026-62832 as soon as it reaches your environment through Windows Update/WSUS, and verify the patched build number against Microsoft's advisory (Microsoft's August 2026 Patch Tuesday wave, which fixed 400+ vulnerabilities, is the likely delivery vehicle). As an interim mitigation for link-following LPEs, restrict the 'Create symbolic links' user right (SeCreateSymbolicLinkPrivilege) to trusted administrators. Prioritize patching multi-user servers, VDI hosts, and endpoints where untrusted users hold local sign-in rights, since this flaw requires an existing low-privileged local account.