User Profile Service CVE-2026-62832

Exploitation requires an authenticated local session on the target Windows system - the CVSS PR:L metric confirms a low-privileged (standard user) account is sufficient; no administrator or special group membership is needed. The attack vector is local (AV:L), meaning the attacker must have an interactive logon, Remote Desktop session, or equivalent authenticated local access. No user interaction from a second account is required (UI:N), and no non-default configuration is needed - the User Profile Service runs by default on all affected Windows installations. Exploitation is constrained by the requirement for prior local authenticated access; remote unauthenticated exploitation is not possible per the AV:L/PR:L vector. Systems with tightly restricted local logon policies or jump-host architectures that prevent direct user sessions reduce practical exploitability.

The CVSS 7.8 High rating is well-calibrated: AV:L requires local access, PR:L limits exploitation to authenticated users, but AC:L and UI:N mean no race condition or victim cooperation is needed, making reliable exploitation straightforward once access is obtained. The full C:H/I:H/A:H triad reflects that a successful exploitation grants SYSTEM privileges - effectively total host compromise. No EPSS data was provided in the intelligence feed; KEV status is not confirmed, and no public exploit code is identified at time of analysis. Despite the absence of KEV listing, the broad affected scope - every supported Windows 10 and 11 build plus Windows Server 2022 and 2025 - combined with low exploitation complexity means this vulnerability should be treated as high operational priority for any organization where post-compromise privilege escalation is a realistic threat scenario. The tags include 'Information Disclosure', which may indicate an additional data-exposure dimension beyond the primary privilege escalation impact, though the CVSS vector's C:H is consistent with either interpretation and should be clarified against the full vendor advisory.

An attacker with a standard local or domain user account on a target Windows system creates a malicious NTFS junction or symbolic link inside a user-writable path processed by the User Profile Service. When the service performs a routine file operation - such as during profile load, cleanup, or folder redirection - it follows the attacker-controlled link and writes to a privileged system location, allowing the attacker to overwrite a DLL or executable loaded by a SYSTEM-level process and achieve code execution as SYSTEM. No public proof-of-concept is identified at time of analysis, but the technique mirrors well-documented Windows link-following primitives used in prior ProfSvc and similar service escalations.