The CVSS 7 rating for CVE-2026-62773 is deceptive. The 'authorized attacker' qualifier creates a false sense of bounded risk — but in Active Directory, 'authorized' means any domain-joined user account, service account, or machine account. That's your entire identity surface, not a narrow blast radius. If an attacker can log into any machine in the domain, they can reach this code path.
This is a use-after-free in Kerberos ticket handling, specifically targeting Windows 10 1607. The UAF class matters: it requires precise heap grooming and temporal control over object lifecycle, suggesting this wasn't trivially discovered. Once published, though, the exploitation primitives will stabilize faster than EPSS models account for — UAF exploits in authentication services historically drop from 'sophisticated' to 'public Metasploit module' quickly.
The more dangerous dimension isn't the CVSS score — it's what happens after successful exploitation. The CVE describes local privilege escalation to SYSTEM, but in AD environments, SYSTEM is a launchpad, not a destination. From SYSTEM on any domain-joined machine, credential dumping and DCSync are immediate next steps. That's not a linear escalation chain; it's a topology collapse where any machine becomes a potential domain replication source.
The Windows 10 1607 targeting is the critical signal. This code has been running unpatched since 2016 — a decade of accumulated exposure debt. Microsoft is still applying delta patches to this branch, but the patching-versus-auditing distinction matters: they're fixing known-bad code without active security review of the underlying authentication pipeline. The 10-year dormancy window also suggests Microsoft's own tooling missed this, which raises the probability that adjacent code paths in the same Kerberos pipeline contain analogous vulnerabilities.
The unanswered question that should drive your prioritization: does the freed object involve ticket session key handling? If this UAF touches session key material rather than just enabling local SYSTEM, you're looking at credential forging at the protocol level — the same class that produced MS14-068. That distinction, not the CVSS aggregate, is what matters.
Patch velocity is the operative concern. Every day this UAF remains unpatched on domain controllers or high-value workstations, the blast radius compounds through credential caching and token reuse. Prioritize domain controllers and privileged workstation assets first — those are the detonation points that collapse your trust topology.