Windows UMPS CVE-2026-62721

Exploitation requires a valid, low-privileged local user account on the target Windows system (PR:L per CVSS vector) - standard domain users or local accounts with basic login rights qualify. The vulnerable component, User-Mode Power Service (UMPS), is a default Windows service present in all affected configurations and requires no special feature enablement or non-default configuration to be present. The attack vector is strictly local (AV:L): the attacker must be able to execute code on the system, via interactive logon, Remote Desktop Protocol session, SSH, or as a secondary stage after an initial compromise. No user interaction is required once local code execution is established (UI:N). Exploitation is limited by the requirement for prior local access - remote unauthenticated exploitation is not supported by the CVSS vector. Scope is unchanged (S:U), indicating the exploit does not pivot directly to other systems at the vulnerability layer, though post-escalation lateral movement is possible.

CVSS 7.8 High with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a locally exploitable, low-complexity privilege escalation with no required user interaction and a full-impact triad post-escalation - a realistic and serious threat in multi-user or managed Windows environments. The low attack complexity (AC:L) is particularly significant: once an attacker holds any local authenticated foothold, exploitation requires no special circumstances, race conditions, or additional configuration states. This CVE is not listed in CISA KEV, so active exploitation is not confirmed; no EPSS data was provided in the input, so exploitation probability cannot be quantitatively assessed. The 'Information Disclosure' tag in the source intelligence is inconsistent with the primary vulnerability classification of privilege escalation; this may indicate a secondary disclosure impact (e.g., reading privileged memory or credentials post-escalation) or a tagging artifact - the CVSS impact metrics (C:H/I:H/A:H) and description unambiguously point to LPE as the primary risk. The breadth of affected platforms - 19 distinct Windows configurations spanning a 14-year release range from Server 2012 to Windows 11 26H1 - substantially amplifies organizational exposure, particularly for environments with extended support or legacy Windows Server deployments.

An attacker with a low-privileged Windows account - obtained through phishing, credential stuffing, or as a standard domain user - invokes an under-restricted UMPS interface on an unpatched workstation or server, bypassing the coarse access control boundary to trigger a privileged power management operation. Due to the low attack complexity (AC:L) and absence of required user interaction, the attacker immediately escalates to SYSTEM-level privileges, enabling installation of persistence mechanisms, credential dumping, or lateral movement. No public exploit code is known at time of analysis, but the AC:L rating indicates a functional exploit would not require sophisticated technique.