CVE-2026-62721

The EPSS score of 0.0033 on this CVE tells you something the CVSS 7.8 obscures: this vulnerability sits in operational territory that threat actors consistently deprioritize. User-Mode Power Service controls sleep, hibernate, and shutdown transitions—it's a narrow functional domain, not a gateway to core system resources. Even a successful SYSTEM-level privilege escalation through UMPS doesn't automatically yield code execution in sensitive services, lateral movement, or persistence. It yields power state control from a non-admin context. The "authorized attacker" qualifier in the description matters more than the severity score suggests. This isn't an unauthenticated bug—it requires pre-compromise of a non-privileged account with specific UMPS permissions. That门槛 filters opportunistic exploitation significantly. The "insufficient granularity of access control" language points to an authorization scoping problem rather than a simple bypass; exploiting it reliably requires reconstructing the service's trust model, which demands research investment that this obscure component has never attracted. For prioritization: treat this as a defense-in-depth fix, not an emergency. Patch it on standard cadence rather than sprinting, but do patch it—the account contexts that make this exploitable aren't static. Permission boundaries widen over time for troubleshooting and rarely tighten back. The "authorized attacker" context today may become a wider attack surface tomorrow as fleet configurations evolve. The EPSS correctly signals that weaponization is unlikely in the near term; it doesn't signal that the exposure window will never widen.

Reviewed through automated stages and approved by a human before publication.