Windows Backup Engine CVE-2026-62687

Exploitation requires the attacker to already have valid low-privileged local access (PR:L) to the Windows host and the ability to create or control filesystem links (symbolic links or NTFS junctions) within a path processed by the Windows Backup Engine; the attacker then relies on a backup or restore operation resolving that link to a protected target. LIMITING FACTORS: it is not remotely exploitable (AV:L), cannot be triggered without authentication, requires the Windows Backup Engine component to be invoked, and affects only unpatched builds below the fixed versions listed in EUVD (e.g., Windows 11 24H2 below 10.0.26100.9711, Windows 10 22H2 below 10.0.19044.7807). Impact is confined to information disclosure - no integrity or availability effect.

This is a moderate, low-priority local information-disclosure flaw rather than a widespread emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5) consistently indicates a LOCAL attack requiring pre-existing low-level authenticated access (PR:L) with no user interaction, yielding high confidentiality impact but no integrity or availability impact. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be mass-scripted at scale), Technical Impact=partial. There is no CISA KEV listing and no public exploit identified, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified here. All signals agree and are mutually consistent - the local vector, required privileges, and SSVC 'none/no/partial' ratings all point to a low-real-risk issue despite the HIGH confidentiality sub-score. The main caveat is that 'authorized attacker' in the description aligns with PR:L but the exact privilege level and which files/data can be disclosed are not detailed by the input; verify specific impact scope with Microsoft's MSRC advisory.

A local, already-authenticated user on a Windows host abuses the Windows Backup Engine's improper handling of symbolic links or junctions so that a backup/restore operation follows an attacker-controlled link and reads a file the user should not be able to access, disclosing its contents. No public proof-of-concept exploit is identified, and the low attack complexity means a knowledgeable local user could trigger it reliably, but it cannot be performed remotely or without valid credentials.