What is the CVSS score of CVE-2026-62698?

CVE-2026-62698 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Windows Digest Authentication are affected by CVE-2026-62698?

A privilege escalation flaw in Microsoft Digest Authentication (CVE-2026-62698) enables low-privilege users to achieve full system control on Windows systems from Server 2012 through Windows 11…. A patch is available.

How to fix or mitigate CVE-2026-62698?

Within 24 hours, conduct rapid inventory of all Windows systems running Server 2012 through Server 2025 and Windows 10/11 (through version 26H1), and immediately apply Microsoft's released patches to Tier 1 systems (domain controllers, identity infrastructure, highly-privileged workstations). Within 7 days, complete patching of all remaining affected Windows systems in production environments, prioritizing systems with local user accounts and administrative data access. Within 30 days, conduct full patch compliance verification across your Windows estate, audit and restrict low-privilege account creation policies, and establish continuous monitoring for authentication subsystem anomalies and local privilege escalation attempts.

Windows Digest Authentication CVE-2026-62698

EUVD-2026-56628 HIGH

Numeric Truncation Error (CWE-197)

2026-08-11 secure@microsoft.com

GHSA-xjfr-3m4h-x4p4

Information Disclosure Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Requires existing low-privilege local account to reach the authentication subsystem; no interaction needed, and truncation yields full privilege escalation with no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 20:34 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Numeric truncation error in Microsoft Digest Authentication allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation via numeric truncation in Microsoft's Digest Authentication subsystem affects a broad range of Windows releases, from Server 2012 through Windows 11 version 26H1 and Windows Server 2025. An attacker holding a low-privilege local account can exploit a CWE-197 integer type-conversion flaw to achieve full system compromise - the CVSS vector assigns high impact across confidentiality, integrity, and availability with no user interaction required. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; however, Microsoft has released patches for all affected build ranges.

Technical ContextAI

CWE-197 (Numeric Truncation Error) describes defects where a numeric value loses precision or changes semantics when converted between types of differing widths - for example, a 32-bit unsigned integer silently truncated to 16 bits, altering size calculations or buffer-boundary checks. Microsoft Digest Authentication (historically wdigest.dll) implements the HTTP Digest scheme (RFC 2617) and Windows-proprietary extensions, processing credential material during local and network authentication. Affected products span the Windows NT 6.x kernel family (Server 2012/2012 R2) and the NT 10.0 family (Windows 10, Windows 11, Server 2016 through 2025), as confirmed by EUVD-2026-56628 build-range data. A truncation flaw within authentication processing could corrupt internal length fields or pointer arithmetic, enabling memory manipulation that subverts Windows privilege enforcement.

RemediationAI

Microsoft has released cumulative updates patching this vulnerability across all affected Windows versions. Administrators should apply updates that bring system builds to or above the following fixed thresholds: Server 2012 to 6.2.9200.26279, Server 2012 R2 to 6.3.9600.23337, Windows 10 1607 and Server 2016 to 10.0.14393.9418, Windows 10 1809 and Server 2019 to 10.0.17763.9115, Windows 10 21H2 to 10.0.19044.7663, Windows 10 22H2 to 10.0.19045.7663, Server 2022 to 10.0.20348.5499, Windows 11 23H2 to 10.0.22631.7517, Windows 11 24H2 to 10.0.26100.9168, Server 2025 to 10.0.26100.33296, Windows 11 25H2 to 10.0.26200.9168, and Windows 11 26H1 to 10.0.28000.2704. The vendor advisory with patch download links is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62698. Where immediate patching is not feasible, reducing the local attack surface by enforcing least-privilege account models and restricting interactive logon rights to only necessary personnel limits who can reach the vulnerable code path; this does not eliminate the flaw and should be treated as a temporary measure only.