CVE-2026-62772

Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 25th percentile. Fixed in 10.0.28000.2704.

CVSS 3.17.8High EPSS percentile25th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix10.0.28000.2704Upgrade to this build

Published 2026-08-11Updated 2026-08-13Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Microsoft Windows 11 version 26H1Affected: ≥ 10.0.28000.0, < 10.0.28000.2704Upgrade to: 10.0.28000.2704Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your Windows 11 device has Windows Container Isolation / unionfs.sys FS filter driver in use.
Verify whether you are already on Windows 11 build 10.0.28000.2704 or later.
Install the Microsoft August 2026 Patch Tuesday update that includes the fix for CVE-2026-62772.
If you can’t patch right away, restrict who has local logon access to the affected machine and limit container usage until the update is applied.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-62772 is a Windows 11 bug that can let a local, low-privilege user gain full control of your computer, mainly if you use Windows containers; if you’re running Windows 11 with container isolation enabled, you should update.

CVE-2026-62772 is a local privilege escalation in the Windows Container Isolation FS Filter Driver (unionfs.sys) that allows an authorized low-privilege user to crash or corrupt memory via sending excessive data, leading to elevated privileges on Windows 11.

If you're affected

Full PC takeover
Access to sensitive files
Account and settings compromise
Service disruption from crashes

What is it

This is a security weakness in a Windows driver used for container isolation. If someone already has basic access to the computer, they may be able to overwhelm the driver’s handling of data and turn that into full control of the machine. Think of it like a safety guard on a door that can be broken if someone inside the building pushes too hard—after that, they can get past normal protections.

Who is affected

This matters to you if you run Windows 11 on devices where Windows Container Isolation is used (the unionfs.sys file system filter driver is reachable in that setup). It’s primarily a risk for someone who already has local access (low-privilege), and it does not require special user clicks. The risk is gated by local access and by whether this container isolation driver is reachable on your configuration.

How urgent is it

This is RED because the bug enables local privilege escalation to full host control, which can quickly turn an ordinary account into system-level access. Even though there are no reported active attacks in dated reporting and no public exploit code on record, you should treat this as a serious patching priority for any Windows 11 machines using container isolation. Patch Tuesday included this fix, so you should move it to the top of your update queue.

What to do — in detail

Confirm exposure

Determine whether the device is running Windows 11 with Windows Container Isolation / unionfs.sys reachable.
Check your OS/build level against the vendor fix requirement: the patch is fixed in Windows 11 10.0.28000.2704.

Upgrade / fix

Upgrade to Windows 11 build 10.0.28000.2704 or later by installing the Microsoft August 2026 Patch Tuesday update that includes CVE-2026-62772.
If you manage multiple devices, prioritize those that both (a) use Windows containers/container isolation and (b) have multiple users or any elevated local access risk.

Temporary workaround (if you can’t patch immediately)

Reduce local access risk: ensure only trusted staff can log on locally with any low-privilege account that could be used to attempt the escalation.
If container isolation isn’t required for operations, pause/disable container usage on the affected hosts until patching is complete.

After patching

Monitor for normal post-update stability; since the flaw can involve crashing/corruption via excessive data handling, unexpected reboots or driver-related errors should be investigated.
Review access logs for unusual local account activity around the time updates were applied.

KEV / timeline

This CVE is not listed in CISA KEV based on the provided findings, so there is no CISA-driven “already exploited” date to follow from KEV alone.

Technical context

Summary and severity

CVE-2026-62772 is a local privilege escalation (CWE-122) in Windows Container Isolation FS Filter Driver (unionfs.sys) on Windows 11.

Mechanism (how it’s triggered)

An authorized low-privilege user can send excessive data that leads to crash or memory corruption, enabling elevation of privilege to take over the host.

Exploitation status and maturity

No KEV listing is provided and no dated in-the-wild exploitation claim is reported in the findings.
No public exploit code is on record (per findings), suggesting exploit availability is not confirmed.

Patch guidance

The fix is available for Windows 11 and the finding states it is fixed in 10.0.28000.2704.

Predicted likelihood

EPSS is given as a prediction with a flat trend; however, exploitation confirmation is not provided in KEV/news findings, so the priority is still driven by the high-impact local privilege escalation and the availability of a patch.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS25th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 25th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 2 days, from the signal feeds we watch.

2026-08-13OpenVAS check addedpatch available, record updated
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- Windows 11 version 26H1OSOn-premOperating Systems / windows

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable