CVE-2026-62728

This vulnerability is like a “check-then-use” mistake in Windows where the system looks at a file, then later uses it without re-checking that it’s still the same file. If someone with a normal account can time the change just right, they can trick Windows into giving them administrator-level control. That can let attackers (or a careless insider) take over the computer and do almost anything.

This matters if your business uses Windows 10, Windows 11, or affected Windows Server versions listed for CVE-2026-62728. It specifically impacts systems where an attacker can log in as a standard (low-privilege) user account.

It’s a risk on reachable systems in default configuration, and the attacker needs a valid low-privilege account on the machine (no special user interaction is required).

This is RED because it’s an elevation-of-privilege bug that can turn a normal logged-in account into full administrator control, which is the kind of foothold attackers and insiders value. Even though no public exploit code is recorded and there’s no specific dated CVE incident report here, the patch availability means you should treat this as urgent for any systems that could be accessed by standard users.

Confirm exposure

1. Identify the exact Windows edition and version on each affected machine (Windows 10/11 and the listed Windows Server versions).
2. Determine the currently installed OS build number (the build number is what the MS fix cards reference).
3. Compare your build against the fixed builds below for your edition.

Fixed versions to use

• Windows 10:
  • fixed in 10.0.14393.9418
  • fixed in 10.0.17763.9121
  • fixed in 10.0.19044.7663
  • fixed in 10.0.19045.7663
• Windows 11:
  • fixed in 10.0.22631.7517
  • fixed in 10.0.26100.9168
  • fixed in 10.0.26200.9168
  • fixed in 10.0.28000.2704
• Windows Server 2012:
  • fixed in 6.2.9200.26280
• Windows Server 2012 R2:
  • fixed in 6.3.9600.23338
• Windows Server 2016:
  • fixed in 10.0.14393.9418
• Windows Server 2019:
  • fixed in 10.0.17763.9121

Patch guidance

1. Download and install the Microsoft security update for CVE-2026-62728 using the MSRC update guide.
2. Reboot if required and re-check the build number to confirm the update is actually installed.

Temporary mitigation if patching is delayed

1. Reduce the number of standard accounts that can log on to these systems; remove or disable accounts that are not strictly needed.
2. Treat any “standard user” logins as potentially dangerous until patched—focus on unusual activity from non-admin accounts.
3. Monitor for signs of privilege changes and suspicious file-system related behavior consistent with attempts to exploit race conditions.

What to monitor after patching

• Successful installation and correct OS build verification.
• Security logs for unusual actions around file operations by non-admin users.
• Any alerts that indicate local privilege escalation attempts.

KEV note

• This CVE is not listed in the CISA KEV catalog in the provided findings.

CVE-2026-62728 is a local privilege escalation in the Windows Common Log File System Driver. The mechanism is a TOCTOU race condition: the driver checks a file’s state and then later uses it without sufficient protection against changes in between, allowing a low-privilege authenticated attacker to manipulate the timing to obtain higher-level (administrator) access.

In the provided findings, it is reachable in default configuration and requires a valid low-privilege account; no user interaction is required. There is no public exploit code on record, and there is no KEV listing. The provided EPSS prediction is 0.2% with a flat trend, but exploitation status in this dataset is driven primarily by the RED verdict and the patch-focused reporting. The fixed versions are provided per OS branch via MSRC.