CVE-2026-62721 Windows User-Mode Power Service (UMPS) Elevation of Privilege Vulnerability

Api.Msrc.Microsoft • September 14, 2026

We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies

Released: Aug 11, 2026

Last updated: Sep 14, 2026

Please see Common Vulnerability Scoring System for more information on the definition of these metrics.

Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally.

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle .

Security Hotpatch Update 

The CVE was updated with links to security updates for Windows 11, version 26H1, 25H2, and 24H2 to address a missed fix. Microsoft recommends installing these updates as soon as possible.

Updated an acknowledgement. This is an informational change only.

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Disclosed for Microsoft Products with Privilege Escalation Risks On September 15, 2026, Microsoft disclosed several vulnerabilities affecting its products, including CVE-2026-55121, CVE-2026-62753, CVE-2026-62721, CVE-2026-49805, CVE-2026-61923, CVE-2026-50683, and CVE-2026-50688. These vulnerabilities include out-of-bounds reads, heap-based buffer overflows, and improper access controls, allowing attackers to elevate privileges to SYSTEM level. The vulnerabilities affect various Microsoft products, including Windows and Microsoft Office. Attack vectors include malicious Office files and specific protocol settings. The vulnerabilities have varying levels of attack complexity, with some requiring user interaction. Microsoft recommends applying security updates as soon as possible to mitigate risks. The CVEs have been assigned CVSS scores indicating potential impacts on confidentiality, integrity, and availability. 9 sources 59

Extracted Entities

CVE-2026-62721 Windows User-Mode Power Service (UMPS) Elevation of Privilege Vulnerability

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)