CVE-2026-62832: Windows User Profile Service Elevation of Privilege Vulnerability

CVE-2026-62832 is an elevation of privilege vulnerability in Windows User Profile Service, rated Important by Microsoft, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as more likely. It was publicly disclosed before the fix was released. The EPSS model estimates a 0.37% probability of exploitation activity in the next 30 days, higher than 31% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday, delivered through 9 security updates (KB5120242, KB5120229, KB5120249, KB5120233 and more). It affects 18 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2026-62832

Severity

High CVSS 7.8

Microsoft severity

Important

Impact

Elevation of Privilege

Exploited in the wild

No

Publicly disclosed

Yes

Exploitation likelihood

More Likely

Weakness

CWE-59

EPSS

0.37% (percentile 31%)

CISA KEV

Not listed

Released

11 August 2026

Last updated

11 August 2026

Patch Tuesday

August 2026 Patch Tuesday

Product families

Windows, ESU

From the August 2026 Patch Tuesday briefing

Windows User Profile Service Elevation of Privilege Vulnerability

This issue is publicly disclosed and affects the Windows User Profile Service, with CWE-59 (Link Following). The most realistic exploitation pattern for link-following bugs in Windows services is local privilege escalation via crafted reparse points/symlinks/hardlinks that redirect privileged file operations to attacker-chosen targets. Attackers typically need local execution and the ability to manipulate filesystem objects in locations the service touches during profile operations.

From the briefing, written by an AI model from PatchaPalooza's data.

CVSS score and vector

Microsoft scores CVE-2026-62832 at 7.8 (temporal 6.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Description

Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.

Frequently asked questions (Microsoft)

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain ADMINISTRATOR privileges.

How could an attacker exploit this vulnerability?

An authenticated attacker who has credentials for another local account could run a specially crafted application to load another user's registry hive. Successful exploitation could allow the attacker to access or modify another user's data and gain administrator privileges. User interaction is not required.

Affected products (18)

Windows

ESU

Security updates (9)

• KB5120242 (Security Update)
• KB5120229 (Security Hotpatch Update)
• KB5120249 (Security Update)
• KB5120233 (Security Update)
• KB5120228 (Security Hotpatch Update)
• KB5121003 (Security Update)
• KB5120994 (Security Hotpatch Update)
• KB5120240 (Security Update)
• KB5121000 (Security Update)

NIST NVD data

NVD status

Analyzed

NVD CVSS

7.8 (HIGH)

NVD weakness

CWE-59

Published to NVD

11 August 2026

NVD last modified

13 August 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62832 (Vendor Advisory)

Acknowledgments

• Anonymous
• Anonymous

Revision history

Related vulnerabilities

Other Windows User Profile Service vulnerabilities

• CVE-2026-83659: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7.8, October 2026)
• CVE-2022-26904: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7, April 2022)
• CVE-2022-21919: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7, January 2022)
• CVE-2022-21895: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7.8, January 2022)
• CVE-2021-34484: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7.8, August 2021)
• CVE-2021-26873: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7, March 2021)
• CVE-2020-0785: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7, March 2020)
• CVE-2020-0730: Windows User Profile Service Elevation of Privilege Vulnerability (Medium, CVSS 6.3, February 2020)

More from the August 2026 Patch Tuesday

• CVE-2026-68820: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (High, CVSS 7, exploited)
• CVE-2026-62893: Windows Deployment Services TFTP Server Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2026-62878: Windows DNS Server Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2026-65791: Windows iSCSI Target Service Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2026-62815: Microsoft QUIC Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2026-62823: Windows DHCP Server Remote Code Execution Vulnerability (High, CVSS 8.8)
• CVE-2026-61358: Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-61925: Windows Installer Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-61930: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-62688: Windows MIDI Service Module Elevation of Privileges Vulnerability (High, CVSS 7.8)
• CVE-2026-62696: Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-62698: Microsoft Digest Authentication Elevation of Privilege Vulnerability (High, CVSS 7.8)

All vulnerabilities of this release: August 2026 Patch Tuesday · August 2026 briefing

Sources

• Microsoft Security Update Guide: CVE-2026-62832
• NIST NVD: CVE-2026-62832
• CVE.org record: CVE-2026-62832