What is the CVSS score of CVE-2026-62777?

CVE-2026-62777 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows License Manager are affected by CVE-2026-62777?

The Windows License Manager privilege escalation (CVE-2026-62777, CVSS 7.8) allows standard users with local system access to achieve full administrative control across Windows 10, 11, and Windows…. A patch is available.

How to fix or mitigate CVE-2026-62777?

Within 24 hours, inventory all Windows 10, Windows 11, and Windows Server systems (2016-2025) and verify current patch levels against CVE-2026-62777 vendor advisories. Within 7 days, complete patching for Windows 11 (all versions 23H2-26H1) and Windows Server 2016-2025, prioritizing production servers and administrative workstations. Within 30 days, finish patching all remaining Windows 10 systems (versions 1607-22H2); establish monthly compliance scans and implement local administrator restrictions or privilege access management on any systems where patching is delayed beyond 30 days.

Windows License Manager CVE-2026-62777

EUVD-2026-56382 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-11 secure@microsoft.com

GHSA-3hr6-jp44-x65h

Authentication Bypass Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local attack vector confirmed by description; PR:L because attacker needs an authorized low-privileged local session; full C/H/I/A reflecting complete privilege escalation to SYSTEM.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 19:27 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Missing authentication for critical function in Windows License Manager allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation in Windows License Manager exposes a critical authenticated-but-low-privileged local attacker path to full SYSTEM-level control across a wide range of Windows client and server builds. The root cause (CWE-306) is a missing authentication gate on a privileged License Manager function - an authorized standard user can invoke it without satisfying the elevated-privilege check that should protect it. Microsoft has released patches covering Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2016 through 2025; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Windows License Manager is a Windows OS component responsible for managing software licensing and entitlements. CWE-306 (Missing Authentication for Critical Function) describes a situation where a function that performs sensitive or privileged operations fails to verify that the caller holds the required authentication level before proceeding. In this case, a function within the License Manager service or API surface does not enforce the authentication or authorization boundary between standard users and privileged operations, allowing a low-privileged local caller to trigger behavior that should be restricted to elevated or SYSTEM-level principals. The CVSS vector AV:L/AC:L/PR:L/UI:N confirms the attack is strictly local, requires no special configuration, and requires no user interaction beyond the attacker holding a standard local session. Affected CPE strings span Windows NT kernel builds from 10.0.14393.x (Windows 10 1607 / Server 2016) through 10.0.28000.x (Windows 11 26H1).

RemediationAI

Vendor-released patches are available for all affected versions via Microsoft Update and Windows Server Update Services. Administrators should apply the following patched builds at minimum: Windows 10 1607 → 10.0.14393.9418; Windows 10 1809/Server 2019 → 10.0.17763.9115; Windows 10 21H2 → 10.0.19044.7663; Windows 10 22H2 → 10.0.19045.7663; Windows 11 23H2 → 10.0.22631.7517; Windows 11 24H2 → 10.0.26100.9168; Windows 11 25H2 → 10.0.26200.9168; Windows 11 26H1 → 10.0.28000.2704; Windows Server 2022 → 10.0.20348.5499; Windows Server 2025 → 10.0.26100.33296. Consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62777 for the full update catalog entries. As a compensating control where immediate patching is not feasible, restrict interactive and remote desktop logon rights to only trusted administrative accounts on high-value servers - this reduces the pool of principals who could reach the vulnerable function, though it does not eliminate the flaw. In shared-access environments (RDS, VDI), prioritize patching before standard user sessions are re-enabled.