CVE-2026-62721

Windows has a built-in power-related service called the User-Mode Power Service (UMPS). This flaw weakens how Windows decides who is allowed to do what inside that service, so a person who already has local access on the machine may be able to climb to higher privileges—like turning a limited account into something closer to full control. If that happens, it can make it easier for malware to take over or stay hidden.

This matters if you run Microsoft Windows desktop or server editions listed (Windows 10, Windows 11, and Windows Server 2012/2016/2019/2022/2025, plus Windows Server 2012 R2). The risk is mainly for machines where an attacker already has some local access, because the vulnerability requires an authorized local attacker rather than being a simple internet-to-admin bypass. In other words, you should focus on patching the affected machines, especially those exposed to common entry points like stolen credentials, remote desktop access, or malware already present.

VERDICT: RED. The vulnerability is a local elevation-of-privilege issue, which means it becomes serious when an attacker already has a foothold on a device—then they can raise privileges and broaden the damage. Microsoft has fixes available, and press attention is pointing to a fresh patch cycle, so prioritize deployment of the available updates on all affected systems.