CVE-2026-62721Patch(microsoft / windows_10_1607)

HIGHCVSS 7.8 · HIGH

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch microsoft windows_10_1607 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts

Recommended action window: Immediate (within 24h)

NVD description

Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally.

microsoft CVEs Back to dashboard

6.5/ 10 priority

Sources & remediation

Patch / fix

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62721

Weakness type (CWE)

CWE-1220

Priority

HIGH

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2

Threat summary

Active exploitation appears in 1 classified signals
Exploit tooling references are present in monitored signal
Patch or workaround signal is available
7 mentions across 4 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 1 signal
Patch or workaround mentioned in 6 signals
Technical details provided in 5 signals
Disclosure: 1 classified signal
Peaked 2d ago at 3 mentions (2026-09-15); latest day: 1
7 total mentions across 4 days

Affected systems

Vendors

microsoft

Products

windows_10_1607windows_10_1809windows_10_21h2windows_10_22h2windows_11_23h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2012windows_server_2016

2 versions affected across 13 products

Deep dive

Activity timeline7 mentions / 4d

Signal classification3 categories

Patch

571.4%

Disclosure

114.3%

Active Exploitation

114.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-14	1	Disclosure1
2026-09-15	3	Patch3
2026-09-16	2	Patch2
2026-09-18	1	Active Exploitation1

Full discourse7 posts

Alireza Naji@AlirezaNaji_44d
Patch
📌 آپدیت اضطراری 2026-09 Security Update (KB5129195) (26200.9457) برای ویندوز 11 در دسترس قرار گرفت. مایکروسافت این نسخه را خارج از برنامه منتشر کرده که چندین آسیب پذیری و باگ مهم و همچنین CVE-2026-62721 را که از ماه آگوست باید دریافت می‌شد، رفع کرده است. #ویندوز https://t.co/r566ICt4Lk
Post summary
Microsoft released an emergency out-of-band security update (KB5129195) for Windows 11 that addresses CVE-2026-62721 and several other vulnerabilities and bugs.
10070517
1.6K followersView on X
Imran Awan@imran76awan45d
Patch
⚠️ If your RDS servers are hit: do NOT roll back the September CU. Apply KB5129195 on top instead. Rolling back reopens whatever CVE-2026-62721 and the rest of that CU were patching. #WindowsUpdate
Post summary
The text focuses on patch guidance for CVE-2026-62721, warning RDS server administrators not to roll back the September cumulative update and to apply KB5129195 instead. It does not provide PoC, exploit tooling, active exploitation claims, or detailed vulnerability mechanics.
11030840
755 followersView on X
Imran Awan@imran76awan45d
Patch
Also bundled in: CVE-2026-62721, a local EoP in the Windows User-Mode Power Service. CVSS not yet published - but being the only CVE in an emergency OOB release is itself a signal to treat it as high priority. #CVE #Security
Post summary
The post highlights CVE-2026-62721, a local EoP in Windows User-Mode Power Service, noting its inclusion in an emergency out-of-band release as a high-priority signal.
10020532
755 followersView on X
SabatAge@sabatage44d
Patch
Windows 11 emergency OOB: KB5129195 for 24H2/25H2 (builds 26100.9457 / 26200.9457). It rolls back the Sept Patch Tuesday pain — RDP, sign-in, admin tools, Hyper-V Linux share, USB audio — and finishes the CVE-2026-62721 EoP fix in User-Mode Power Service (UMPS). Expect ~10 minutes + one restart. Check Windows Update now. Note: some AMD GPU / Explorer weirdness from the Tuesday stack may still linger.
Post summary
The tweet announces a Windows 11 emergency out-of-band update (KB5129195) that rolls back September Patch Tuesday issues and completes the fix for CVE-2026-62721, an elevation of privilege vulnerability in the User-Mode Power Service.
00010315
5.0K followersView on X
SecureChap@SecureChap42d
Active Exploitation
An unauthenticated attacker could have seized control of Azure AI Foundry with a single CVSS 10 flaw that Microsoft fixed server-side with no customer steps required. CVE-2026-85889 stemmed from missing authentication on a critical function, letting any network caller escalate without credentials. The September 18 2026 advisory listed no observed exploitation. CVE-2026-85885 allowed command injection in Microsoft 365 Copilot via an authorized network path. CVE-2026-85878 bypassed authorization checks in Azure Database for PostgreSQL. CVE-2026-87701 failed to neutralize input in Azure Cosmos DB. All three carried CVSS 9.9 scores and were already mitigated server-side. CVE-2026-62721 gave SYSTEM to a local attacker in Windows User-Mode Power Service because access control checks lacked granularity. The September 2026 Cumulative Update KB5129194 shipped build 28000.2956 for Windows 11 26H1 on arm64 and x64. CVE-2026-85921 triggered a double free in Windows Secure Kernel Mode on the same out-of-band package, enabling elevation to VTL1. Microsoft addressed 974 vulnerabilities that week. An actively exploited ALPC flaw was chained with two Chrome bugs into the BlueMoon kit used by targeted actors. Defenders should verify the latest cumulative updates are applied across Windows and Azure workloads.
Post summary
The text reports active exploitation of an ALPC flaw chained into the BlueMoon kit used by targeted actors. It additionally details Microsoft's patching of 974 vulnerabilities across Windows and Azure workloads.
00000108
172 followersView on X
“Remodeling-Plarail”＆スマホSite@jun1Naka_46d
Patch
「なぜ、いきなり更新が始まったのか？」——KB5129195緊急パッチから読み解くWindows Updateの構造変化 https://xn--ecka7j.biz/toolboox/windows11/14639/ Windows Updateが突然始まった理由を徹底解説。KB5129195緊急パッチ（OOB）の背景にある、前回の更新による重大障害とセキュリティ脆弱性（CVE-2026-62721）の正体を解明。 https://t.co/9c4N1xEtZN
Post summary
The text focuses on an emergency Windows patch (KB5129195) addressing CVE-2026-62721, explaining its necessity due to prior update failures and a security vulnerability.
00000201
16 followersView on X
太鼓屋P@taikoyaP46d
Disclosure
Windows User-Mode Power Service (UMPS) の特権昇格の脆弱性 CVE-2026-62721 https://msrc.microsoft.com/update-guide/advisory/CVE-2026-62721
Post summary
The text announces CVE-2026-62721 as a privilege escalation vulnerability affecting Windows UMPS and links to the MSRC advisory, serving as an initial vulnerability disclosure without exploitation details, PoC, or explicit remediation guidance.
00000257
2.3K followersView on X

CPE platform detail24 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

24 of 24 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_10_1607	-	-	x64
OS	microsoft	windows_10_1607	-	-	x86
OS	microsoft	windows_10_1809	-	-	x64
OS	microsoft	windows_10_1809	-	-	x86
OS	microsoft	windows_10_21h2	-	-	arm64
OS	microsoft	windows_10_21h2	-	-	x64
OS	microsoft	windows_10_21h2	-	-	x86
OS	microsoft	windows_10_22h2	-	-	arm64
OS	microsoft	windows_10_22h2	-	-	x64
OS	microsoft	windows_10_22h2	-	-	x86
OS	microsoft	windows_11_23h2	-	-	arm64
OS	microsoft	windows_11_23h2	-	-	x64
OS	microsoft	windows_11_24h2	-	-	arm64
OS	microsoft	windows_11_24h2	-	-	x64
OS	microsoft	windows_11_25h2	-	-	arm64
OS	microsoft	windows_11_25h2	-	-	x64
OS	microsoft	windows_11_26h1	-	-	arm64
OS	microsoft	windows_11_26h1	-	-	x64
OS	microsoft	windows_server_2012	-	-	-
OS	microsoft	windows_server_2012	r2	-	-
OS	microsoft	windows_server_2016	-	-	-
OS	microsoft	windows_server_2019	-	-	-
OS	microsoft	windows_server_2022	-	-	-
OS	microsoft	windows_server_2025	-	-	-

Explore more

Back to dashboard microsoft CVEs windows_10_1607 vulnerabilities

What researchers are saying

CVE-2026-62721

SabatAge[verified]@sabatagePatch

The tweet announces a Windows 11 emergency out-of-band update (KB5129195) that rolls back September Patch Tuesday issues and completes the fix for CVE-2026-62721, an elevation of privilege vulnerability in the User-Mode Power Service.

SecureChap[verified]@SecureChapActive Exploitation

The text reports active exploitation of an ALPC flaw chained into the BlueMoon kit used by targeted actors. It additionally details Microsoft's patching of 974 vulnerabilities across Windows and Azure workloads.

Alireza Naji@AlirezaNaji_Patch

Microsoft released an emergency out-of-band security update (KB5129195) for Windows 11 that addresses CVE-2026-62721 and several other vulnerabilities and bugs.

Imran Awan@imran76awanPatch

The text focuses on patch guidance for CVE-2026-62721, warning RDS server administrators not to roll back the September cumulative update and to apply KB5129195 instead. It does not provide PoC, exploit tooling, active exploitation claims, or detailed vulnerability mechanics.

Imran Awan@imran76awanPatch

The post highlights CVE-2026-62721, a local EoP in Windows User-Mode Power Service, noting its inclusion in an emergency out-of-band release as a high-priority signal.

“Remodeling-Plarail”＆スマホSite@jun1Naka_Patch

The text focuses on an emergency Windows patch (KB5129195) addressing CVE-2026-62721, explaining its necessity due to prior update failures and a security vulnerability.

太鼓屋P@taikoyaPDisclosure

The text announces CVE-2026-62721 as a privilege escalation vulnerability affecting Windows UMPS and links to the MSRC advisory, serving as an initial vulnerability disclosure without exploitation details, PoC, or explicit remediation guidance.