CVE-2026-62832 – Windows User Profile Service Elevation of Privilege Vulnerability

Windows User Profile Service contains an improper link resolution vulnerability that can allow an authenticated local attacker to elevate privileges. An attacker with credentials for another local account could run a specially crafted application to load another user's registry hive, potentially accessing or modifying that user's data and gaining administrator privileges. No user interaction is required.

CVSS Score: 7.8.

SEVERITY: Important.

THREAT:
An attacker who already has local access and the required account credentials could exploit this vulnerability to gain administrator privileges. Successful exploitation can result in high confidentiality, integrity, and availability impact.

EXPLOITS:
The vulnerability is publicly disclosed, but it is not reported as exploited. Exploit code maturity is Unproven, and exploitation is assessed as More Likely. No confirmed public exploit or proof-of-concept code is identified.

TECHNICAL SUMMARY:
The vulnerability is caused by improper link resolution before file access (CWE-59) in Windows User Profile Service. An authenticated attacker with credentials for another local account could execute a specially crafted application that causes another user's registry hive to be loaded. Successful exploitation could enable access to or modification of another user's data and elevate the attacker to administrator privileges. The attack is local, has low attack complexity, requires low privileges, and requires no user interaction.

EXPLOITABILITY:
Affected software includes Windows 10 versions 21H2 and 22H2, Windows 11 versions 24H2 and 26H1, Windows Server 2022, and Windows Server 2025, including the listed Server Core installations and supported architectures. Exploitation requires authenticated local access, credentials for another local account, and execution of a specially crafted application.

BUSINESS IMPACT:
Administrator-level privilege escalation can turn limited local access into broad control of an affected system. Successful exploitation could expose or alter another user's data and compromise system confidentiality, integrity, and availability, increasing the potential impact of an existing foothold inside an organization.

WORKAROUND:
No workaround or mitigation is identified. An official fix is available.

URGENCY:
The vulnerability is publicly disclosed and exploitation is assessed as More Likely. Although active exploitation is not reported, organizations should prioritize deployment because successful exploitation could provide administrator privileges and compromise sensitive user data.