CVE-2026-72947 Microsoft CVE debrief

Who should care

System administrators and security teams responsible for managing and securing Windows systems, especially those with high privilege escalation risk.

Why it matters

CVE-2026-72947 is an integer underflow vulnerability in the Windows File History Service that allows an authorized attacker to elevate privileges locally. System administrators and security teams should verify and apply patches, monitor system logs, and review vulnerability management processes to mitigate this vulnerability.

• Verify and apply patches to vulnerable Windows systems to prevent local privilege escalation.
• Monitor system logs for potential exploitation attempts to detect possible attacks.
• Review and update vulnerability management processes to ensure timely patching of Windows systems.

Technical summary

The vulnerability is caused by an integer underflow (wrap or wraparound) in the Windows File History Service. An authorized attacker can exploit this vulnerability to elevate privileges locally. The vulnerability has a CVSS score of 6.4 and a severity of MEDIUM.

Defensive priority

Apply patches or mitigations to vulnerable Windows systems, especially those with high privilege escalation risk.

Recommended defensive actions

• Apply patches or mitigations to vulnerable Windows systems, especially those with high privilege escalation risk.
• Review and update vulnerability management processes to ensure timely patching of Windows systems.
• Monitor system logs for potential exploitation attempts.

Evidence notes

The vulnerability is described in the CVE Program record and the NVD vulnerability detail page. Microsoft has released a vendor advisory and patch for this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.