CVE-2026-62687
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to disclose information locally.
Risk Assessment
An attacker with local access could abuse the backup mechanism to read files they are not normally authorized to access.
Recommendation
Install Windows security patches and restrict permissions for backup operations.
Other vulnerabilities in Windows Backup Engine
See all- CVE-2026-70184High
An improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
- CVE-2026-108135High
An improper link resolution before file access ('link following') vulnerability in the Windows Backup Engine allows an authorized attacker to elevate privileges locally.
- CVE-2026-62908High
Concurrent execution using shared resource with improper synchronization (race condition) in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
- CVE-2026-58598High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
- CVE-2026-50406High
A use-after-free vulnerability in the Windows Backup Engine allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to disclose information locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS