‹ Back to list

CVE-2026-62765

High (8.1)—
Schedule the patchSeverity High 8.1. No public exploit or active exploitation known.
Vendor advisory· msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62765
Severity8.1High · CVSS 3.1
Exploitation probability0.43 %higher than 38% of CVEs · score from Nov 11, 2026
Active exploitationNonot in the CISA catalog · checked Nov 12, 04:00 AM
Public exploitNot knownno public code found

News and reports on Orbitaley

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Timeline

Built from our own data: NVD, CISA KEV and other exploitation catalogues, FIRST EPSS, public exploits, specialised media and Orbitaley coverage.

  1. CVE record published in NVD
  2. Alert: Microsoft fixes a type confusion flaw in Edge that allows remote code execution
  3. Record last modified in NVD

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

El vector CVSS AV:N/PR:N/UI:R exige interacción del usuario y la descripción indica ejecución de código remota en Microsoft Edge, por lo que es explotación para ejecución en el cliente.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Restrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationExecution PreventionBehavior Prevention on EndpointDisable or Remove Feature or Program

Affected technologies (1)

Microsoft — Edge Chromium

NVD record

NVD status
Analyzed
Published
Oct 27, 2026
Last modified
Nov 3, 2026
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-843

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-62765",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-62765",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-30T13:39:34.621753Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Microsoft Edge (Chromium-based)",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.0",
              "lessThan": "149.0.4022.62",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-27T22:17:29.267",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62765",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@microsoft.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-843"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network."
    }
  ],
  "lastModified": "2026-11-03T18:09:36.307",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0F04236-C2E6-425A-AD32-4B53CD2342FC",
              "versionEndExcluding": "149.0.4022.62"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}