Intel

CVE-2026-62832

microsoft windows_10_21h2: Improper Link Resolution Before File Access ('Link Following')

highEPSS 0.4%

Affected

  • microsoft/windows_10_21h2 lt *..10.0.19044.7663
  • microsoft/windows_10_21h2 lt *..10.0.19044.7663
  • microsoft/windows_10_21h2 lt *..10.0.19044.7663
  • microsoft/windows_10_22h2 lt *..10.0.19045.7663
  • microsoft/windows_10_22h2 lt *..10.0.19045.7663
  • microsoft/windows_10_22h2 lt *..10.0.19045.7663
  • microsoft/windows_11_23h2 lt *..10.0.22631.7517
  • microsoft/windows_11_23h2 lt *..10.0.22631.7517
  • microsoft/windows_11_24h2 lt *..10.0.26100.9168
  • microsoft/windows_11_24h2 lt *..10.0.26100.9168
  • microsoft/windows_11_25h2 lt *..10.0.26200.9168
  • microsoft/windows_11_25h2 lt *..10.0.26200.9168
  • microsoft/windows_11_26h1 lt *..10.0.28000.2704
  • microsoft/windows_11_26h1 lt *..10.0.28000.2704
  • microsoft/windows_server_2022 lt *..10.0.20348.5499
  • microsoft/windows_server_2025 lt *..10.0.26100.33296

Description

Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.

Source: BSI WID PortalBSI CSAFcvelistv5NVD (NIST)Microsoft Security Update Guide

Affected operating systems

  • windows

    microsoft / windows_10_21h2

  • windows

    microsoft / windows_10_22h2

  • windows

    microsoft / windows_11_23h2

  • windows

    microsoft / windows_11_24h2

  • windows

    microsoft / windows_11_25h2

  • windows

    microsoft / windows_11_26h1

  • windows

    microsoft / windows_server_2022

  • windows

    microsoft / windows_server_2025

Metrics

XIEM Effective CVSS
7.8
Source: nvd-v3
EPSS percentile
28.9 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
high
Priority score
70.70
Exploit maturity
no public PoC known
CVSS v3
7.8
EPSS score
0.4 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-11 17:06 UTC
CWE
CWE-59

Weakness classes (CWE)

  • CWE-59Base

    Improper Link Resolution Before File Access ('Link Following')

    The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. New CVE Received2026-08-11 17:18 UTC· secure@microsoft.com
    • Affected: Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 23H2 (+7)
    • Description: Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.
    • CVSS V3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    • CWE: CWE-59

Linked advisories