CVE-2026-62708

CVE-2026-62708 is a Windows kernel use-after-free that allows arbitrary code execution at ring zero, but it carries a physical attack prerequisite—and that classification should change how you respond, though not in the way the CVSS 6.4 might suggest. The physical access requirement is not a reassuring guardrail. Most organizations cannot honestly audit who had physical access to their endpoints in the past 90 days. Laptops leave facilities, conference room kiosks persist across reorgs, and the physical perimeter is the security control that fails most catastrophically while generating the weakest audit trail. The prerequisite doesn't mean exploitation is unlikely—it means exploitation is invisible when it happens. More critically, the physical attack classification degrades over time. Historical pattern shows this: DMA interfaces like Thunderbolt and FireWire externalize the physical component to adjacent machines, cold-boot techniques convert memory remanence into practical credential extraction, and adjacent information disclosure bugs enable kernel ASLR bypass that converts local-only issues into more tractable exploit chains. Today's physical-only vulnerability is tomorrow's network-adjacent issue. The real blast radius isn't local privilege escalation to SYSTEM—that's the first domino. The second-order impact is attestation subversion. With kernel code execution, an attacker can manipulate TPM-backed remote attestation, compromising every Zero Trust claim that machine makes from that point forward. This damage persists long after the physical access window closes and cannot be rotated out without rebuilding the device. For endpoints that serve as trust anchors for conditional access policies, this isn't a 6.4 problem—it's a supply chain integrity problem. Your response should be tiered by device role. For kiosks and shared systems with no conditional access dependencies, prioritize physical security hardening—restrict USB access, enforce boot authentication, enable Credential Guard. For endpoints serving as attestation anchors for sensitive workloads, the calculus shifts: the patch matters not because exploitation is likely, but because successful exploitation has irreversible collateral damage that hardening controls cannot contain. Define explicitly what your acceptable exposure window is for a disclosed ring-zero primitive in your environment, and assign accountability for closing it.

Reviewed through automated stages and approved by a human before publication.