CVE-2026-62832

HighCVSS 7.8/10Last modified Aug 13, 2026

Description

Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published: Aug 11, 2026
Last modified: Aug 13, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-628349.8Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.CVE-2026-628357.5Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.CVE-2026-6283610.0Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate CVE-2026-628376.5Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.CVE-2026-628396.5Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.CVE-2026-62849.1An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. Th CVE-2026-628407.0Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-628425.5Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.CVE-2026-628436.8File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Fro CVE-2026-628454.7Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statem CVE-2026-62857.5Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Passwor CVE-2026-628578.8Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10,