Windows User-Mode Power Service (UMPS) Elevation of Privilege Vulnerability

CVE-2026-62721 is an elevation of privilege vulnerability in User-Mode Power Service (UMPS) (rated Important, CVSS 7.8).

1 version

Microsoft id: CVE-2026-62721
Products: User-Mode Power Service (UMPS)
Severity: Important
Impact: Elevation of Privilege
CVSS: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Exploited: No
Publicly disclosed: No
Exploitability: Exploitation More Likely
Customer action required: Yes
Release: 2026-Aug
Assigned by: Microsoft
Weakness: CWE-1220: Insufficient Granularity of Access Control
MSRC revision: 2.0
First captured by us: 13 Nov 2026, 15:59 UTC (from our first import of this list)
Microsoft last modified: 14 Sep 2026, 14:00 UTC
Source: Security updates · open the original at Microsoft

Microsoft's revision notes

Revision 1.0, 2026-08-11: Information published.
Revision 1.1, 2026-08-17: Updated an acknowledgement. This is an informational change only.
Revision 2.0, 2026-09-14: The CVE was updated with links to security updates for Windows 11, version 26H1, 25H2, and 24H2 to address a missed fix.

Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally.

Security updates, 14:00 UTC, 14 Sep

One version so far. If Microsoft edits it, each change shows here with what was removed and added.

First version we captured · 15:59 UTC, 13 Nov
The text as we first saw it
Seen by us 15:59 UTC, 13 Nov · Microsoft's timestamp 14:00 UTC, 14 Sep · Microsoft's page

Last updated 13 Nov 2026, 15:59 UTC